From a3f8dc04df0ec4a34496b1c5fee83cf2d2338f09 Mon Sep 17 00:00:00 2001
From: Matthew Harmsen <mharmsen@redhat.com>
Date: Tue, 1 Oct 2013 10:10:01 -0700
Subject: [PATCH] Stand-alone DRM

* TRAC Ticket #667 - provide option for ca-less drm install
---
 base/ca/shared/conf/CS.cfg.in                      |    8 +-
 base/ca/shared/profiles/ca/AdminCert.cfg           |   86 ++
 base/ca/shared/profiles/ca/caStorageCert.cfg       |   85 ++
 base/ca/shared/profiles/ca/caSubsystemCert.cfg     |   85 ++
 .../cms/servlet/csadmin/ConfigurationUtils.java    |   53 +-
 .../cms/servlet/csadmin/SystemConfigService.java   |  139 +++-
 base/kra/shared/conf/CS.cfg.in                     |    1 +
 base/kra/shared/webapps/kra/WEB-INF/web.xml        |  167 ++++
 .../kra/KeyRecoveryAuthorityApplication.java       |   16 +
 base/ocsp/shared/conf/CS.cfg.in                    |    1 +
 base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml      |  167 ++++
 .../src/com/netscape/ocsp/OCSPApplication.java     |   17 +
 base/server/config/pkislots.cfg                    |    3 +
 base/server/etc/default.cfg                        |   55 ++-
 .../python/pki/server/deployment/pkihelper.py      |  874 +++++++++++++++++---
 .../python/pki/server/deployment/pkimessages.py    |   33 +-
 .../python/pki/server/deployment/pkiparser.py      |   43 +-
 .../server/deployment/scriptlets/configuration.py  |    8 +-
 .../server/deployment/scriptlets/finalization.py   |    6 +-
 .../server/deployment/scriptlets/initialization.py |    9 +-
 base/server/sbin/pkispawn                          |   29 +-
 base/server/scripts/operations                     |   40 +
 .../com/netscape/cmsutil/crypto/CryptoUtil.java    |    8 +
 23 files changed, 1774 insertions(+), 159 deletions(-)
 create mode 100644 base/ca/shared/profiles/ca/AdminCert.cfg
 create mode 100644 base/ca/shared/profiles/ca/caStorageCert.cfg
 create mode 100644 base/ca/shared/profiles/ca/caSubsystemCert.cfg

diff --git a/base/ca/shared/conf/CS.cfg.in b/base/ca/shared/conf/CS.cfg.in
index f5519f0..2f12b51 100644
--- a/base/ca/shared/conf/CS.cfg.in
+++ b/base/ca/shared/conf/CS.cfg.in
@@ -958,7 +958,7 @@ oidmap.pse.oid=2.16.840.1.113730.1.18
 oidmap.subject_info_access.class=netscape.security.extensions.SubjectInfoAccessExtension
 oidmap.subject_info_access.oid=1.3.6.1.5.5.7.1.11
 os.userid=nobody
-profile.list=caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caECDualCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caOtherCert,caCACert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caTransportCert,caDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,caFullCMCUserCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caEncECUserCert
+profile.list=caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caECDualCert,AdminCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caSubsystemCert,caOtherCert,caCACert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caStorageCert,caTransportCert,caDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,caFullCMCUserCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caEncECUserCert
 profile.caUUIDdeviceCert.class_id=caEnrollImpl
 profile.caUUIDdeviceCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caUUIDdeviceCert.cfg
 profile.caManualRenewal.class_id=caEnrollImpl
@@ -967,6 +967,8 @@ profile.caDirUserRenewal.class_id=caEnrollImpl
 profile.caDirUserRenewal.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caDirUserRenewal.cfg
 profile.caSSLClientSelfRenewal.class_id=caEnrollImpl
 profile.caSSLClientSelfRenewal.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caSSLClientSelfRenewal.cfg
+profile.AdminCert.class_id=caEnrollImpl
+profile.AdminCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/AdminCert.cfg
 profile.DomainController.class_id=caEnrollImpl
 profile.DomainController.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/DomainController.cfg
 profile.caAgentFileSigning.class_id=caEnrollImpl
@@ -1027,6 +1029,8 @@ profile.caSignedLogCert.class_id=caEnrollImpl
 profile.caSignedLogCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caSignedLogCert.cfg
 profile.caSimpleCMCUserCert.class_id=caEnrollImpl
 profile.caSimpleCMCUserCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caSimpleCMCUserCert.cfg
+profile.caSubsystemCert.class_id=caEnrollImpl
+profile.caSubsystemCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caSubsystemCert.cfg
 profile.caTPSCert.class_id=caEnrollImpl
 profile.caTPSCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caTPSCert.cfg
 profile.caAdminCert.class_id=caEnrollImpl
@@ -1049,6 +1053,8 @@ profile.caTokenUserSigningKeyEnrollment.class_id=caUserCertEnrollImpl
 profile.caTokenUserSigningKeyEnrollment.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caTokenUserSigningKeyEnrollment.cfg
 profile.caTokenMSLoginEnrollment.class_id=caUserCertEnrollImpl
 profile.caTokenMSLoginEnrollment.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caTokenMSLoginEnrollment.cfg
+profile.caStorageCert.class_id=caEnrollImpl
+profile.caStorageCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caStorageCert.cfg
 profile.caTransportCert.class_id=caEnrollImpl
 profile.caTransportCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caTransportCert.cfg
 profile.caUserCert.class_id=caEnrollImpl
diff --git a/base/ca/shared/profiles/ca/AdminCert.cfg b/base/ca/shared/profiles/ca/AdminCert.cfg
new file mode 100644
index 0000000..a54a1b7
--- /dev/null
+++ b/base/ca/shared/profiles/ca/AdminCert.cfg
@@ -0,0 +1,86 @@
+desc=This certificate profile is for enrolling Administrator's certificates suitable for use by clients such as browsers.
+visible=true
+enable=true
+enableBy=admin
+auth.instance_id=
+name=Manual Administrator Certificate Enrollment
+input.list=i1,i2,i3
+input.i1.class_id=certReqInputImpl
+input.i2.class_id=submitterInfoInputImpl
+input.i3.class_id=subjectDNInputImpl
+output.list=o1
+output.o1.class_id=certOutputImpl
+policyset.list=adminCertSet
+policyset.adminCertSet.list=1,2,3,4,5,6,7,8
+policyset.adminCertSet.1.constraint.class_id=subjectNameConstraintImpl
+policyset.adminCertSet.1.constraint.name=Subject Name Constraint
+policyset.adminCertSet.1.constraint.params.pattern=.*
+policyset.adminCertSet.1.constraint.params.accept=true
+policyset.adminCertSet.1.default.class_id=userSubjectNameDefaultImpl
+policyset.adminCertSet.1.default.name=Subject Name Default
+policyset.adminCertSet.1.default.params.name=
+policyset.adminCertSet.2.constraint.class_id=validityConstraintImpl
+policyset.adminCertSet.2.constraint.name=Validity Constraint
+policyset.adminCertSet.2.constraint.params.range=365
+policyset.adminCertSet.2.constraint.params.notBeforeCheck=false
+policyset.adminCertSet.2.constraint.params.notAfterCheck=false
+policyset.adminCertSet.2.default.class_id=validityDefaultImpl
+policyset.adminCertSet.2.default.name=Validity Default
+policyset.adminCertSet.2.default.params.range=365
+policyset.adminCertSet.2.default.params.startTime=0
+policyset.adminCertSet.3.constraint.class_id=keyConstraintImpl
+policyset.adminCertSet.3.constraint.name=Key Constraint
+policyset.adminCertSet.3.constraint.params.keyType=RSA
+policyset.adminCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
+policyset.adminCertSet.3.default.class_id=userKeyDefaultImpl
+policyset.adminCertSet.3.default.name=Key Default
+policyset.adminCertSet.4.constraint.class_id=noConstraintImpl
+policyset.adminCertSet.4.constraint.name=No Constraint
+policyset.adminCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
+policyset.adminCertSet.4.default.name=Authority Key Identifier Default
+policyset.adminCertSet.5.constraint.class_id=noConstraintImpl
+policyset.adminCertSet.5.constraint.name=No Constraint
+policyset.adminCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
+policyset.adminCertSet.5.default.name=AIA Extension Default
+policyset.adminCertSet.5.default.params.authInfoAccessADEnable_0=true
+policyset.adminCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
+policyset.adminCertSet.5.default.params.authInfoAccessADLocation_0=
+policyset.adminCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
+policyset.adminCertSet.5.default.params.authInfoAccessCritical=false
+policyset.adminCertSet.5.default.params.authInfoAccessNumADs=1
+policyset.adminCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
+policyset.adminCertSet.6.constraint.name=Key Usage Extension Constraint
+policyset.adminCertSet.6.constraint.params.keyUsageCritical=true
+policyset.adminCertSet.6.constraint.params.keyUsageDigitalSignature=true
+policyset.adminCertSet.6.constraint.params.keyUsageNonRepudiation=true
+policyset.adminCertSet.6.constraint.params.keyUsageDataEncipherment=true
+policyset.adminCertSet.6.constraint.params.keyUsageKeyEncipherment=true
+policyset.adminCertSet.6.constraint.params.keyUsageKeyAgreement=false
+policyset.adminCertSet.6.constraint.params.keyUsageKeyCertSign=false
+policyset.adminCertSet.6.constraint.params.keyUsageCrlSign=false
+policyset.adminCertSet.6.constraint.params.keyUsageEncipherOnly=false
+policyset.adminCertSet.6.constraint.params.keyUsageDecipherOnly=false
+policyset.adminCertSet.6.default.class_id=keyUsageExtDefaultImpl
+policyset.adminCertSet.6.default.name=Key Usage Default
+policyset.adminCertSet.6.default.params.keyUsageCritical=true
+policyset.adminCertSet.6.default.params.keyUsageDigitalSignature=true
+policyset.adminCertSet.6.default.params.keyUsageNonRepudiation=true
+policyset.adminCertSet.6.default.params.keyUsageDataEncipherment=true
+policyset.adminCertSet.6.default.params.keyUsageKeyEncipherment=true
+policyset.adminCertSet.6.default.params.keyUsageKeyAgreement=false
+policyset.adminCertSet.6.default.params.keyUsageKeyCertSign=false
+policyset.adminCertSet.6.default.params.keyUsageCrlSign=false
+policyset.adminCertSet.6.default.params.keyUsageEncipherOnly=false
+policyset.adminCertSet.6.default.params.keyUsageDecipherOnly=false
+policyset.adminCertSet.7.constraint.class_id=noConstraintImpl
+policyset.adminCertSet.7.constraint.name=No Constraint
+policyset.adminCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
+policyset.adminCertSet.7.default.name=Extended Key Usage Extension Default
+policyset.adminCertSet.7.default.params.exKeyUsageCritical=false
+policyset.adminCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.4
+policyset.adminCertSet.8.constraint.class_id=signingAlgConstraintImpl
+policyset.adminCertSet.8.constraint.name=No Constraint
+policyset.adminCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withEC,SHA512withEC
+policyset.adminCertSet.8.default.class_id=signingAlgDefaultImpl
+policyset.adminCertSet.8.default.name=Signing Alg
+policyset.adminCertSet.8.default.params.signingAlg=-
diff --git a/base/ca/shared/profiles/ca/caStorageCert.cfg b/base/ca/shared/profiles/ca/caStorageCert.cfg
new file mode 100644
index 0000000..3d99883
--- /dev/null
+++ b/base/ca/shared/profiles/ca/caStorageCert.cfg
@@ -0,0 +1,85 @@
+desc=This certificate profile is for enrolling Data Recovery Manager storage certificates.
+visible=true
+enable=true
+enableBy=admin
+auth.class.id=
+name=Manual Data Recovery Manager Storage Certificate Enrollment
+input.list=i1,i2
+input.i1.class_id=certReqInputImpl
+input.i2.class_id=submitterInfoInputImpl
+output.list=o1
+output.o1.class_id=certOutputImpl
+policyset.list=drmStorageCertSet
+policyset.drmStorageCertSet.list=1,2,3,4,5,6,7,9
+policyset.drmStorageCertSet.1.constraint.class_id=subjectNameConstraintImpl
+policyset.drmStorageCertSet.1.constraint.name=Subject Name Constraint
+policyset.drmStorageCertSet.1.constraint.params.pattern=CN=.*
+policyset.drmStorageCertSet.1.constraint.params.accept=true
+policyset.drmStorageCertSet.1.default.class_id=userSubjectNameDefaultImpl
+policyset.drmStorageCertSet.1.default.name=Subject Name Default
+policyset.drmStorageCertSet.1.default.params.name=
+policyset.drmStorageCertSet.2.constraint.class_id=validityConstraintImpl
+policyset.drmStorageCertSet.2.constraint.name=Validity Constraint
+policyset.drmStorageCertSet.2.constraint.params.range=720
+policyset.drmStorageCertSet.2.constraint.params.notBeforeCheck=false
+policyset.drmStorageCertSet.2.constraint.params.notAfterCheck=false
+policyset.drmStorageCertSet.2.default.class_id=validityDefaultImpl
+policyset.drmStorageCertSet.2.default.name=Validity Default
+policyset.drmStorageCertSet.2.default.params.range=720
+policyset.drmStorageCertSet.2.default.params.startTime=0
+policyset.drmStorageCertSet.3.constraint.class_id=keyConstraintImpl
+policyset.drmStorageCertSet.3.constraint.name=Key Constraint
+policyset.drmStorageCertSet.3.constraint.params.keyType=RSA
+policyset.drmStorageCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
+policyset.drmStorageCertSet.3.default.class_id=userKeyDefaultImpl
+policyset.drmStorageCertSet.3.default.name=Key Default
+policyset.drmStorageCertSet.4.constraint.class_id=noConstraintImpl
+policyset.drmStorageCertSet.4.constraint.name=No Constraint
+policyset.drmStorageCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
+policyset.drmStorageCertSet.4.default.name=Authority Key Identifier Default
+policyset.drmStorageCertSet.5.constraint.class_id=noConstraintImpl
+policyset.drmStorageCertSet.5.constraint.name=No Constraint
+policyset.drmStorageCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
+policyset.drmStorageCertSet.5.default.name=AIA Extension Default
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADEnable_0=true
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADLocation_0=
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
+policyset.drmStorageCertSet.5.default.params.authInfoAccessCritical=false
+policyset.drmStorageCertSet.5.default.params.authInfoAccessNumADs=1
+policyset.drmStorageCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
+policyset.drmStorageCertSet.6.constraint.name=Key Usage Extension Constraint
+policyset.drmStorageCertSet.6.constraint.params.keyUsageCritical=true
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDigitalSignature=true
+policyset.drmStorageCertSet.6.constraint.params.keyUsageNonRepudiation=true
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDataEncipherment=true
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyEncipherment=true
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyAgreement=false
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyCertSign=false
+policyset.drmStorageCertSet.6.constraint.params.keyUsageCrlSign=false
+policyset.drmStorageCertSet.6.constraint.params.keyUsageEncipherOnly=false
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDecipherOnly=false
+policyset.drmStorageCertSet.6.default.class_id=keyUsageExtDefaultImpl
+policyset.drmStorageCertSet.6.default.name=Key Usage Default
+policyset.drmStorageCertSet.6.default.params.keyUsageCritical=true
+policyset.drmStorageCertSet.6.default.params.keyUsageDigitalSignature=true
+policyset.drmStorageCertSet.6.default.params.keyUsageNonRepudiation=true
+policyset.drmStorageCertSet.6.default.params.keyUsageDataEncipherment=true
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyEncipherment=true
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyAgreement=false
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyCertSign=false
+policyset.drmStorageCertSet.6.default.params.keyUsageCrlSign=false
+policyset.drmStorageCertSet.6.default.params.keyUsageEncipherOnly=false
+policyset.drmStorageCertSet.6.default.params.keyUsageDecipherOnly=false
+policyset.drmStorageCertSet.7.constraint.class_id=noConstraintImpl
+policyset.drmStorageCertSet.7.constraint.name=No Constraint
+policyset.drmStorageCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
+policyset.drmStorageCertSet.7.default.name=Extended Key Usage Extension Default
+policyset.drmStorageCertSet.7.default.params.exKeyUsageCritical=false
+policyset.drmStorageCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2
+policyset.drmStorageCertSet.9.constraint.class_id=signingAlgConstraintImpl
+policyset.drmStorageCertSet.9.constraint.name=No Constraint
+policyset.drmStorageCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withEC,SHA512withEC
+policyset.drmStorageCertSet.9.default.class_id=signingAlgDefaultImpl
+policyset.drmStorageCertSet.9.default.name=Signing Alg
+policyset.drmStorageCertSet.9.default.params.signingAlg=-
diff --git a/base/ca/shared/profiles/ca/caSubsystemCert.cfg b/base/ca/shared/profiles/ca/caSubsystemCert.cfg
new file mode 100644
index 0000000..41a710f
--- /dev/null
+++ b/base/ca/shared/profiles/ca/caSubsystemCert.cfg
@@ -0,0 +1,85 @@
+desc=This certificate profile is for enrolling subsystem certificates.
+visible=true
+enable=true
+enableBy=admin
+auth.class_id=
+name=Manual Subsystem Certificate Enrollment
+input.list=i1,i2
+input.i1.class_id=certReqInputImpl
+input.i2.class_id=submitterInfoInputImpl
+output.list=o1
+output.o1.class_id=certOutputImpl
+policyset.list=serverCertSet
+policyset.serverCertSet.list=1,2,3,4,5,6,7,8
+policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl
+policyset.serverCertSet.1.constraint.name=Subject Name Constraint
+policyset.serverCertSet.1.constraint.params.pattern=CN=.*
+policyset.serverCertSet.1.constraint.params.accept=true
+policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl
+policyset.serverCertSet.1.default.name=Subject Name Default
+policyset.serverCertSet.1.default.params.name=
+policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl
+policyset.serverCertSet.2.constraint.name=Validity Constraint
+policyset.serverCertSet.2.constraint.params.range=720
+policyset.serverCertSet.2.constraint.params.notBeforeCheck=false
+policyset.serverCertSet.2.constraint.params.notAfterCheck=false
+policyset.serverCertSet.2.default.class_id=validityDefaultImpl
+policyset.serverCertSet.2.default.name=Validity Default
+policyset.serverCertSet.2.default.params.range=720
+policyset.serverCertSet.2.default.params.startTime=0
+policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
+policyset.serverCertSet.3.constraint.name=Key Constraint
+policyset.serverCertSet.3.constraint.params.keyType=-
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096,nistp256,nistp384,nistp521
+policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
+policyset.serverCertSet.3.default.name=Key Default
+policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
+policyset.serverCertSet.4.constraint.name=No Constraint
+policyset.serverCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
+policyset.serverCertSet.4.default.name=Authority Key Identifier Default
+policyset.serverCertSet.5.constraint.class_id=noConstraintImpl
+policyset.serverCertSet.5.constraint.name=No Constraint
+policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
+policyset.serverCertSet.5.default.name=AIA Extension Default
+policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true
+policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
+policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=
+policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
+policyset.serverCertSet.5.default.params.authInfoAccessCritical=false
+policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1
+policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
+policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint
+policyset.serverCertSet.6.constraint.params.keyUsageCritical=true
+policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true
+policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true
+policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true
+policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true
+policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false
+policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false
+policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false
+policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false
+policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false
+policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl
+policyset.serverCertSet.6.default.name=Key Usage Default
+policyset.serverCertSet.6.default.params.keyUsageCritical=true
+policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true
+policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=true
+policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true
+policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true
+policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false
+policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false
+policyset.serverCertSet.6.default.params.keyUsageCrlSign=false
+policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false
+policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false
+policyset.serverCertSet.7.constraint.class_id=noConstraintImpl
+policyset.serverCertSet.7.constraint.name=No Constraint
+policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
+policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default
+policyset.serverCertSet.7.default.params.exKeyUsageCritical=false
+policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2
+policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl
+policyset.serverCertSet.8.constraint.name=No Constraint
+policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withEC,SHA512withEC
+policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl
+policyset.serverCertSet.8.default.name=Signing Alg
+policyset.serverCertSet.8.default.params.signingAlg=-
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index c8d4422..3b2a50f 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -2244,15 +2244,29 @@ public class ConfigurationUtils {
                 String machineName = config.getString("machineName", "");
                 String securePort = config.getString("service.securePort", "");
                 if (certTag.equals("subsystem")) {
-                    String content =
-                            "requestor_name="
-                                    + sysType + "-" + machineName + "-" + securePort + "&profileId=" + profileId
-                                    + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
-                                    + "&xmlOutput=true&sessionID=" + session_id;
-                    cert = CertUtil.createRemoteCert(sd_hostname, sd_ee_port,
-                            content, response, panel);
-                    if (cert == null) {
-                        throw new IOException("Error: remote certificate is null");
+                    boolean standalone = false;
+                    if (sysType.equals("KRA")) {
+                        standalone = config.getBoolean("kra.standalone", false);
+                    } else if (sysType.equals("OCSP")) {
+                        standalone = config.getBoolean("ocsp.standalone", false);
+                    }
+
+                    if ((sysType.equals("KRA")  && standalone) ||
+                        (sysType.equals("OCSP") && standalone)) {
+                        // Treat Standalone KRA/OCSP the same as "otherca"
+                        config.putString(subsystem + "." + certTag + ".cert",
+                                         "...paste certificate here...");
+                    } else {
+                        String content =
+                                "requestor_name="
+                                        + sysType + "-" + machineName + "-" + securePort + "&profileId=" + profileId
+                                        + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
+                                        + "&xmlOutput=true&sessionID=" + session_id;
+                        cert = CertUtil.createRemoteCert(sd_hostname, sd_ee_port,
+                                content, response, panel);
+                        if (cert == null) {
+                            throw new IOException("Error: remote certificate is null");
+                        }
                     }
                 } else if (v.equals("sdca")) {
                     String ca_hostname = "";
@@ -3134,43 +3148,50 @@ public class ConfigurationUtils {
         String select = config.getString("securitydomain.select", "");
         if (select.equals("new")) {
             group = system.getGroupFromName("Security Domain Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Security Domain Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise CA Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise CA Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise KRA Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise KRA Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise RA Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise RA Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise TKS Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise TKS Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise OCSP Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise OCSP Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
 
             group = system.getGroupFromName("Enterprise TPS Administrators");
-            if (!group.isMember(uid)) {
+            if (group != null && !group.isMember(uid)) {
+                CMS.debug("AdminPanel createAdmin:  add user '" + uid + "' to group 'Enterprise TPS Administrators'");
                 group.addMemberName(uid);
                 system.modifyGroup(group);
             }
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java b/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
index 96c56f7..8170afd 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
@@ -86,6 +86,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
     String csType;
     String csState;
     boolean isMasterCA = false;
+    boolean standalone = false;
     String instanceRoot;
 
     public static String SUCCESS = "0";
@@ -135,7 +136,16 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         validateData(data);
         ConfigurationResponse response = new ConfigurationResponse();
 
+        if (((csType.equals("KRA")  && standalone) ||
+             (csType.equals("OCSP") && standalone)) &&
+            (!(data.getStepTwo() == null))) {
+                // Stand-alone KRA/OCSP (External CA Step 2)
+                // Special case to import the external CA and its Chain
+                certList = "signing" + "," + certList;
+        }
+
         // specify module and log into token
+        CMS.debug("=== Token Panel ===");
         String token = data.getToken();
         if (token == null) {
             token = ConfigurationRequest.TOKEN_DEFAULT;
@@ -143,10 +153,12 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         tokenPanel(data, token);
 
         //configure security domain
+        CMS.debug("=== Security Domain Panel ===");
         String securityDomainType = data.getSecurityDomainType();
         String domainXML = securityDomainPanel(data, securityDomainType);
 
         //subsystem panel
+        CMS.debug("=== Subsystem Panel ===");
         cs.putString("preop.subsystem.name", data.getSubsystemName());
 
         // is this a clone of another subsystem?
@@ -160,6 +172,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         // Hierarchy Panel
+        CMS.debug("=== Hierarchy Panel ===");
         hierarchyPanel(data);
 
         // TPS Panels
@@ -196,10 +209,12 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         // Database Panel
+        CMS.debug("=== Database Panel ===");
         databasePanel(data);
 
         // SizePanel, NamePanel, CertRequestPanel
         //handle the CA URL
+        CMS.debug("=== Size Panel, Name Panel, CertRequest Panel ===");
         try {
             if ((data.getHierarchy() == null) || (data.getHierarchy().equals("join"))) {
                 String url = data.getIssuingCA();
@@ -248,6 +263,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             StringTokenizer t = new StringTokenizer(certList, ",");
             while (t.hasMoreTokens()) {
                 String ct = t.nextToken();
+                String certStr;
                 boolean enable = cs.getBoolean("preop.cert." + ct + ".enable", true);
                 if (!enable) continue;
 
@@ -259,6 +275,42 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
                     if (cdata.getTag().equals(ct)) break;
                 }
 
+                if (((csType.equals("KRA")  && standalone) ||
+                     (csType.equals("OCSP") && standalone)) &&
+                    (!(data.getStepTwo() == null))) {
+                    // Stand-alone KRA/OCSP (External CA Step 2)
+                    if (ct.equals("signing")) {
+                        String b64 = cdata.getCert();
+                        if ((b64!= null) && (b64.length()>0) && (!b64.startsWith("..."))) {
+                            hasSigningCert = true;
+                            if (data.getIssuingCA().equals("External CA")) {
+                                b64 = CryptoUtil.stripCertBrackets(b64.trim());
+                                b64 = CryptoUtil.normalizeCertStr(b64);
+                                cs.putString(csType.toLowerCase() + ".external_ca.cert", b64);
+                                String nickname = (cdata.getNickname() != null) ? cdata.getNickname() : "caSigningCert External CA";
+                                String tokenName = cdata.getToken() != null ? cdata.getToken() : token;
+                                Cert certObj = new Cert(tokenName, nickname, ct);
+                                certObj.setSubsystem(csType.toLowerCase());
+                                certObj.setType(cs.getString("preop.ca.type", "otherca"));
+                                certObj.setCert(CryptoUtil.normalizeCertStr(b64));
+                                CMS.debug("Step 2:  certStr for '" + ct + "' is " + b64);
+
+                                String certChainStr = cdata.getCertChain();
+                                if (certChainStr != null) {
+                                    certChainStr = CryptoUtil.normalizeCertAndReq(certChainStr);
+                                    cs.putString(csType.toLowerCase() + ".external_ca_chain.cert", certChainStr);
+                                    certObj.setCertChain(certChainStr);
+                                    CMS.debug("Step 2:  certChainStr for '" + ct + "' is " + certChainStr);
+                                    certs.addElement(certObj);
+                                } else {
+                                    throw new BadRequestException("CertChain not provided");
+                                }
+                            }
+                            continue;
+                        }
+                    }
+                }
+
                 if (!generateServerCert && ct.equals("sslserver")) {
                     if (!cdata.getToken().equals("internal")) {
                         cs.putString(csType.toLowerCase() + ".cert.sslserver.nickname", cdata.getNickname());
@@ -270,7 +322,6 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
                     cs.putString(csType.toLowerCase() + ".sslserver.cert", cdata.getCert());
                     cs.putString(csType.toLowerCase() + ".sslserver.certreq", cdata.getRequest());
                     cs.putString(csType.toLowerCase() + ".sslserver.tokenname", cdata.getToken());
-                    cs.putString(csType.toLowerCase() + ".sslserver.cert", cdata.getCert());
                     continue;
                 }
 
@@ -320,11 +371,39 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
                     ConfigurationUtils.configCert(null, null, null, certObj, null);
                 } else {
                     String subsystem = cs.getString("preop.cert." + ct + ".subsystem");
-                    String certStr = cs.getString(subsystem + "." + ct + ".cert" );
+                    if ((csType.equals("KRA")  && standalone) ||
+                        (csType.equals("OCSP") && standalone)) {
+                        // Stand-alone KRA/OCSP (External CA Step 2)
+                        certStr = cdata.getCert();
+                        certStr = CryptoUtil.stripCertBrackets(certStr.trim());
+                        certStr = CryptoUtil.normalizeCertStr(certStr);
+                        cs.putString(subsystem + "." + ct + ".cert", certStr);
+                    } else {
+                        certStr = cs.getString(subsystem + "." + ct + ".cert" );
+                    }
+
                     certObj.setCert(certStr);
-                    CMS.debug("Step 2: certStr for " + ct + " is " + certStr);
+                    CMS.debug("Step 2:  certStr for '" + ct + "' is " + certStr);
+                }
+
+                // Handle Cert Requests for everything EXCEPT Stand-alone KRA/OCSP (External CA Step 2)
+                if ((csType.equals("KRA")  && standalone) ||
+                    (csType.equals("OCSP") && standalone)) {
+                    if (data.getStepTwo() == null) {
+                        // Stand-alone KRA/OCSP (External CA Step 1)
+                        ConfigurationUtils.handleCertRequest(cs, ct, certObj);
+
+                        CMS.debug("Stand-alone " + csType + " Admin CSR");
+                        String adminSubjectDN = data.getAdminSubjectDN();
+                        String certreqStr = data.getAdminCertRequest();
+                        certreqStr = CryptoUtil.normalizeCertAndReq(certreqStr);
+                        cs.putString("preop.cert.admin.dn", adminSubjectDN);
+                        cs.putString(csType.toLowerCase() + ".admin.certreq", certreqStr);
+                        cs.putString(csType.toLowerCase() + ".admin.cert", "...paste certificate here...");
+                    }
+                } else {
+                    ConfigurationUtils.handleCertRequest(cs, ct, certObj);
                 }
-                ConfigurationUtils.handleCertRequest(cs, ct, certObj);
 
                 if (data.getIsClone().equals("true")) {
                     ConfigurationUtils.updateCloneConfig();
@@ -363,8 +442,9 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             throw new PKIException("Error in setting certificate names and key sizes: " + e);
         }
 
-        // submitting to external ca
+        // non-Stand-alone KRA/OCSP submitting CSRs to external ca
         if ((data.getIssuingCA()!= null) && data.getIssuingCA().equals("External CA") && (!hasSigningCert)) {
+            CMS.debug("Submit CSRs to external ca . . .");
             response.setSystemCerts(SystemCertDataFactory.create(certs));
             response.setStatus(SUCCESS);
             return response;
@@ -375,19 +455,22 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             Cert cert = c.nextElement();
             int ret;
             try {
+                CMS.debug("Processing '" + cert.getCertTag() + "' certificate:");
                 ret = ConfigurationUtils.handleCerts(cert);
                 ConfigurationUtils.setCertPermissions(cert.getCertTag());
+                CMS.debug("Processed '" + cert.getCertTag() + "' certificate.");
             } catch (Exception e) {
                 e.printStackTrace();
-                throw new PKIException("Error in confguring system certificates" + e);
+                throw new PKIException("Error in configuring system certificates" + e);
             }
             if (ret != 0) {
-                throw new PKIException("Error in confguring system certificates");
+                throw new PKIException("Error in configuring system certificates");
             }
         }
         response.setSystemCerts(SystemCertDataFactory.create(certs));
 
         // BackupKeyCertPanel/SavePKCS12Panel
+        CMS.debug("=== BackupKeyCert Panel/SavePKCS12 Panel ===");
         if (data.getBackupKeys().equals("true")) {
             try {
                 ConfigurationUtils.backupKeys(data.getBackupPassword(), data.getBackupFile());
@@ -398,10 +481,12 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         // AdminPanel
+        CMS.debug("=== Admin Panel ===");
         adminPanel(data, response);
 
         // Done Panel
         // Create or update security domain
+        CMS.debug("=== Done Panel ===");
         try {
             if (securityDomainType.equals(ConfigurationRequest.NEW_DOMAIN)) {
                 ConfigurationUtils.createSecurityDomain();
@@ -426,7 +511,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
 
         // need to push connector information to the CA
         try {
-            if (csType.equals("KRA") && (!ca_host.equals(""))) {
+            if (csType.equals("KRA") && (!standalone) && (!ca_host.equals(""))) {
                 ConfigurationUtils.updateConnectorInfo(CMS.getAgentHost(), CMS.getAgentPort());
                 ConfigurationUtils.setupClientAuthUser();
             }
@@ -441,8 +526,10 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             if (csType.equals("OCSP") && (!ca_host.equals(""))) {
                 CMS.reinit(IOCSPAuthority.ID);
                 ConfigurationUtils.importCACertToOCSP();
-                ConfigurationUtils.updateOCSPConfig();
-                ConfigurationUtils.setupClientAuthUser();
+                if (!standalone) {
+                    ConfigurationUtils.updateOCSPConfig();
+                    ConfigurationUtils.setupClientAuthUser();
+                }
             }
         } catch (Exception e) {
             e.printStackTrace();
@@ -575,6 +662,14 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
                         data.getAdminName(), data.getAdminPassword());
                 if (data.getImportAdminCert().equalsIgnoreCase("true")) {
                     String b64 = CryptoUtil.stripCertBrackets(data.getAdminCert().trim());
+                    if ((csType.equals("KRA")  && standalone) ||
+                        (csType.equals("OCSP") && standalone)) {
+                        // Stand-alone KRA/OCSP (External CA Step 2)
+                        CMS.debug("adminPanel:  Stand-alone " + csType + " Admin Cert");
+                        cs.putString(csType.toLowerCase() + ".admin.cert", b64);
+                        cs.commit(false);
+                    }
+                    // Convert Admin Cert to X509CertImpl
                     byte[] b = CryptoUtil.base64Decode(b64);
                     admincerts[0] = new X509CertImpl(b);
                 } else {
@@ -826,7 +921,13 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             cs.putString("securitydomain.httpsagentport", CMS.getAgentPort());
             cs.putString("securitydomain.httpseeport", CMS.getEESSLPort());
             cs.putString("securitydomain.httpsadminport", CMS.getAdminPort());
-            cs.putString("preop.cert.subsystem.type", "local");
+            // Stand-alone KRA/OCSP (External CA Step 1)
+            if ((csType.equals("KRA")  && standalone) ||
+                (csType.equals("OCSP") && standalone)) {
+                cs.putString("preop.cert.subsystem.type", "remote");
+            } else {
+                cs.putString("preop.cert.subsystem.type", "local");
+            }
             cs.putString("preop.cert.subsystem.profile", "subsystemCert.profile");
         } else {
             cs.putString("preop.securitydomain.select", "existing");
@@ -926,8 +1027,18 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         if (domainType.equals(ConfigurationRequest.NEW_DOMAIN)) {
-            if (!csType.equals("CA")) {
-                throw new BadRequestException("New Domain is only valid for CA subsytems");
+            try {
+                if ((csType.equals("KRA")) || (csType.equals("OCSP"))) {
+                    standalone = cs.getBoolean(csType.toLowerCase() + ".standalone", false);
+                }
+            } catch (EBaseException e) {
+                e.printStackTrace();
+                throw new PKIException("Missing standalone parameter: " + e);
+            }
+            if ((csType.equals("KRA")  && !standalone) ||
+                (csType.equals("OCSP") && !standalone) ||
+                (csType.equals("TKS")) || (csType.equals("TPS"))) {
+                throw new BadRequestException("New Domain is only valid for Stand-alone KRA, Stand-alone OCSP, or CA subsytems");
             }
             if (data.getSecurityDomainName() == null) {
                 throw new BadRequestException("Security Domain Name is not provided");
@@ -1051,7 +1162,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         if (csType.equals("CA") && (data.getHierarchy() == null)) {
-            throw new BadRequestException("Hierarchy is requred for CA, not provided");
+            throw new BadRequestException("Hierarchy is required for CA, not provided");
         }
 
         if (data.getIsClone().equals("false")) {
diff --git a/base/kra/shared/conf/CS.cfg.in b/base/kra/shared/conf/CS.cfg.in
index a201b07..5e7ab45 100644
--- a/base/kra/shared/conf/CS.cfg.in
+++ b/base/kra/shared/conf/CS.cfg.in
@@ -49,6 +49,7 @@ kra.cert.storage.certusage=SSLClient
 kra.cert.sslserver.certusage=SSLServer
 kra.cert.subsystem.certusage=SSLClient
 kra.cert.audit_signing.certusage=ObjectSigner
+kra.standalone=[PKI_STANDALONE]
 preop.cert.list=transport,storage,sslserver,subsystem,audit_signing
 preop.cert.rsalist=transport,storage,audit_signing
 preop.cert.transport.enable=true
diff --git a/base/kra/shared/webapps/kra/WEB-INF/web.xml b/base/kra/shared/webapps/kra/WEB-INF/web.xml
index bcd4513..12f1884 100644
--- a/base/kra/shared/webapps/kra/WEB-INF/web.xml
+++ b/base/kra/shared/webapps/kra/WEB-INF/web.xml
@@ -691,6 +691,121 @@
                          <param-value> kraGetStatus </param-value> </init-param>
    </servlet>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+   <servlet>
+      <servlet-name>  kraGetDomainXML  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.GetDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraGetDomainXML </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraUpdateDomainXML  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.UpdateDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> true       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraUpdateDomainXML </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> agent          </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> certUserDBAuthMgr </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.securitydomain.domainxml </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraUpdateDomainXML-admin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.UpdateDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraUpdateDomainXML </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> admin          </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> TokenAuth </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.securitydomain.domainxml </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraSecurityDomainLogin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.SecurityDomainLogin  </servlet-class>
+            <init-param> <param-name>properties</param-name>
+                         <param-value>/WEB-INF/velocity.properties</param-value> </init-param>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraSecurityDomainLogin  </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.ee.certificates </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraGetCookie  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.GetCookie  </servlet-class>
+            <init-param> <param-name>properties</param-name>
+                         <param-value>/WEB-INF/velocity.properties</param-value> </init-param>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraGetCookie  </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> passwdUserDBAuthMgr </param-value> </init-param>
+             <init-param><param-name>  templatePath  </param-name>
+                         <param-value> /admin/kra/sendCookie.template </param-value> </init-param>
+             <init-param><param-name>  errorTemplatePath  </param-name>
+                         <param-value> /admin/kra/securitydomainlogin.template </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraTokenAuthenticate  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.TokenAuthenticate  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraTokenAuthenticate  </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> ee          </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  kraTokenAuthenticate-admin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.TokenAuthenticate  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> kra         </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> kraTokenAuthenticate  </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> admin          </param-value> </init-param>
+   </servlet>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
 
    <!-- ==================== RESTEasy Configuration =============== -->
 
@@ -943,6 +1058,43 @@
       <url-pattern>   /admin/kra/getStatus  </url-pattern>
    </servlet-mapping>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+   <servlet-mapping>
+      <servlet-name>  kraGetDomainXML </servlet-name>
+      <url-pattern>   /admin/kra/getDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraUpdateDomainXML </servlet-name>
+      <url-pattern>   /agent/kra/updateDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraUpdateDomainXML-admin </servlet-name>
+      <url-pattern>   /admin/kra/updateDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraSecurityDomainLogin </servlet-name>
+      <url-pattern>   /admin/kra/securityDomainLogin  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraGetCookie </servlet-name>
+      <url-pattern>   /admin/kra/getCookie  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraTokenAuthenticate </servlet-name>
+      <url-pattern>   /ee/kra/tokenAuthenticate  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  kraTokenAuthenticate-admin </servlet-name>
+      <url-pattern>   /admin/kra/tokenAuthenticate  </url-pattern>
+   </servlet-mapping>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
    <!-- ==================== Default Session Configuration =============== -->
    <!-- You can set the default session timeout (in minutes) for all newly -->
    <!-- created sessions by modifying the value below.                     -->
@@ -992,6 +1144,21 @@
         </user-data-constraint>
     </security-constraint>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Security Domain Services</web-resource-name>
+            <url-pattern>/rest/securityDomain/installToken</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>*</role-name>
+        </auth-constraint>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
     <login-config>
         <realm-name>Key Recovery Authority</realm-name>
     </login-config>
diff --git a/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java b/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
index f04ee9b..d4bbbf1 100644
--- a/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
+++ b/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
@@ -5,6 +5,9 @@ import java.util.Set;
 
 import javax.ws.rs.core.Application;
 
+import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.base.EBaseException;
+import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.base.PKIException;
 import com.netscape.cms.authorization.ACLInterceptor;
 import com.netscape.cms.authorization.AuthMethodInterceptor;
@@ -16,6 +19,7 @@ import com.netscape.cms.servlet.admin.UserCertService;
 import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.csadmin.SystemConfigService;
+import com.netscape.cms.servlet.csadmin.SecurityDomainService;
 import com.netscape.cms.servlet.key.KeyService;
 import com.netscape.cms.servlet.request.KeyRequestService;
 
@@ -32,6 +36,18 @@ public class KeyRecoveryAuthorityApplication extends Application {
         // installer
         classes.add(SystemConfigService.class);
 
+        // security domain
+        IConfigStore cs = CMS.getConfigStore();
+        try {
+            boolean standalone = cs.getBoolean("kra.standalone", false);
+            if (standalone) {
+                classes.add(SecurityDomainService.class);
+            }
+        } catch (EBaseException e) {
+            CMS.debug(e);
+            throw new RuntimeException(e);
+        }
+
         // keys and keyrequests
         classes.add(KeyService.class);
         classes.add(KeyRequestService.class);
diff --git a/base/ocsp/shared/conf/CS.cfg.in b/base/ocsp/shared/conf/CS.cfg.in
index 8c4d68d..65b8b4c 100644
--- a/base/ocsp/shared/conf/CS.cfg.in
+++ b/base/ocsp/shared/conf/CS.cfg.in
@@ -48,6 +48,7 @@ ocsp.cert.signing.certusage=StatusResponder
 ocsp.cert.sslserver.certusage=SSLServer
 ocsp.cert.subsystem.certusage=SSLClient
 ocsp.cert.audit_signing.certusage=ObjectSigner
+ocsp.standalone=[PKI_STANDALONE]
 preop.cert.ocsp_signing.enable=true
 preop.cert.sslserver.enable=true
 preop.cert.subsystem.enable=true
diff --git a/base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml b/base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml
index b9b8745..9c86fa1 100644
--- a/base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml
+++ b/base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml
@@ -404,6 +404,121 @@
                          <param-value> ocspGetStatus </param-value> </init-param>
    </servlet>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+   <servlet>
+      <servlet-name>  ocspGetDomainXML  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.GetDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspGetDomainXML </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspUpdateDomainXML  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.UpdateDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> true       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspUpdateDomainXML </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> agent          </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> certUserDBAuthMgr </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.securitydomain.domainxml </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspUpdateDomainXML-admin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.UpdateDomainXML  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspUpdateDomainXML </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> admin          </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> TokenAuth </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.securitydomain.domainxml </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspSecurityDomainLogin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.SecurityDomainLogin  </servlet-class>
+            <init-param> <param-name>properties</param-name>
+                         <param-value>/WEB-INF/velocity.properties</param-value> </init-param>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspSecurityDomainLogin  </param-value> </init-param>
+             <init-param><param-name>  resourceID  </param-name>
+                         <param-value> certServer.ee.certificates </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspGetCookie  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.GetCookie  </servlet-class>
+            <init-param> <param-name>properties</param-name>
+                         <param-value>/WEB-INF/velocity.properties</param-value> </init-param>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  AuthzMgr    </param-name>
+                         <param-value> BasicAclAuthz </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspGetCookie  </param-value> </init-param>
+             <init-param><param-name>  AuthMgr     </param-name>
+                         <param-value> passwdUserDBAuthMgr </param-value> </init-param>
+             <init-param><param-name>  templatePath  </param-name>
+                         <param-value> /admin/ocsp/sendCookie.template </param-value> </init-param>
+             <init-param><param-name>  errorTemplatePath  </param-name>
+                         <param-value> /admin/ocsp/securitydomainlogin.template </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspTokenAuthenticate  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.TokenAuthenticate  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspTokenAuthenticate  </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> ee          </param-value> </init-param>
+   </servlet>
+
+   <servlet>
+      <servlet-name>  ocspTokenAuthenticate-admin  </servlet-name>
+      <servlet-class> com.netscape.cms.servlet.csadmin.TokenAuthenticate  </servlet-class>
+             <init-param><param-name>  GetClientCert  </param-name>
+                         <param-value> false       </param-value> </init-param>
+             <init-param><param-name>  authority   </param-name>
+                         <param-value> ocsp        </param-value> </init-param>
+             <init-param><param-name>  ID          </param-name>
+                         <param-value> ocspTokenAuthenticate  </param-value> </init-param>
+             <init-param><param-name>  interface   </param-name>
+                         <param-value> admin          </param-value> </init-param>
+   </servlet>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
    <listener>
       <listener-class> org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap </listener-class>
    </listener>
@@ -576,6 +691,43 @@
       <url-pattern>   /admin/ocsp/getStatus  </url-pattern>
    </servlet-mapping>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+   <servlet-mapping>
+      <servlet-name>  ocspGetDomainXML </servlet-name>
+      <url-pattern>   /admin/ocsp/getDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspUpdateDomainXML </servlet-name>
+      <url-pattern>   /agent/ocsp/updateDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspUpdateDomainXML-admin </servlet-name>
+      <url-pattern>   /admin/ocsp/updateDomainXML  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspSecurityDomainLogin </servlet-name>
+      <url-pattern>   /admin/ocsp/securityDomainLogin  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspGetCookie </servlet-name>
+      <url-pattern>   /admin/ocsp/getCookie  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspTokenAuthenticate </servlet-name>
+      <url-pattern>   /ee/ocsp/tokenAuthenticate  </url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>  ocspTokenAuthenticate-admin </servlet-name>
+      <url-pattern>   /admin/ocsp/tokenAuthenticate  </url-pattern>
+   </servlet-mapping>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
 
    <!-- ==================== Default Session Configuration =============== -->
    <!-- You can set the default session timeout (in minutes) for all newly -->
@@ -613,6 +765,21 @@
         </user-data-constraint>
     </security-constraint>
 
+   [PKI_OPEN_STANDALONE_COMMENT]
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Security Domain Services</web-resource-name>
+            <url-pattern>/rest/securityDomain/installToken</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>*</role-name>
+        </auth-constraint>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+   [PKI_CLOSE_STANDALONE_COMMENT]
+
     <login-config>
         <realm-name>Online Certificate Status Protocol Manager</realm-name>
     </login-config>
diff --git a/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java b/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
index 1dc4a9d..8535664 100644
--- a/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
+++ b/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
@@ -5,6 +5,9 @@ import java.util.Set;
 
 import javax.ws.rs.core.Application;
 
+import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.base.EBaseException;
+import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.base.PKIException;
 import com.netscape.cms.authorization.ACLInterceptor;
 import com.netscape.cms.authorization.AuthMethodInterceptor;
@@ -16,6 +19,7 @@ import com.netscape.cms.servlet.admin.UserCertService;
 import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.csadmin.SystemConfigService;
+import com.netscape.cms.servlet.csadmin.SecurityDomainService;
 
 public class OCSPApplication extends Application {
 
@@ -30,6 +34,19 @@ public class OCSPApplication extends Application {
         // installer
         classes.add(SystemConfigService.class);
 
+        // security domain
+        IConfigStore cs = CMS.getConfigStore();
+        try {
+            boolean standalone = cs.getBoolean("ocsp.standalone", false);
+            if (standalone) {
+                classes.add(SecurityDomainService.class);
+            }
+        } catch (EBaseException e) {
+            CMS.debug(e);
+            throw new RuntimeException(e);
+        }
+
+
         // user and group management
         classes.add(GroupMemberService.class);
         classes.add(GroupService.class);
diff --git a/base/server/config/pkislots.cfg b/base/server/config/pkislots.cfg
index 6e13a89..bb51f53 100644
--- a/base/server/config/pkislots.cfg
+++ b/base/server/config/pkislots.cfg
@@ -44,6 +44,7 @@ PKI_CLOSE_AJP_PORT_COMMENT_SLOT=[PKI_CLOSE_AJP_PORT_COMMENT]
 PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT=[PKI_CLOSE_ENABLE_PROXY_COMMENT]
 PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
 PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT]
+PKI_CLOSE_STANDALONE_COMMENT_SLOT=[PKI_CLOSE_STANDALONE_COMMENT]
 PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT]
 PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME]
 PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT]
@@ -63,6 +64,7 @@ PKI_OPEN_AJP_PORT_COMMENT_SLOT=[PKI_OPEN_AJP_PORT_COMMENT]
 PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT=[PKI_OPEN_ENABLE_PROXY_COMMENT]
 PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT]
 PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT]
+PKI_OPEN_STANDALONE_COMMENT_SLOT=[PKI_OPEN_STANDALONE_COMMENT]
 PKI_PIDDIR_SLOT=[PKI_PIDDIR]
 PKI_PROXY_SECURE_PORT_SLOT=[PKI_PROXY_SECURE_PORT]
 PKI_PROXY_UNSECURE_PORT_SLOT=[PKI_PROXY_UNSECURE_PORT]
@@ -75,6 +77,7 @@ PKI_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_SECURE_PORT_SERVER_COMMENT]
 PKI_SECURITY_MANAGER_SLOT=[PKI_SECURITY_MANAGER]
 PKI_SERVER_XML_CONF_SLOT=[PKI_SERVER_XML_CONF]
 PKI_SSL_SERVER_NICKNAME_SLOT=[PKI_SSL_SERVER_NICKNAME]
+PKI_STANDALONE_SLOT=[PKI_STANDALONE]
 PKI_SUBSYSTEM_TYPE_SLOT=[PKI_SUBSYSTEM_TYPE]
 PKI_SYSTEMD_SERVICENAME_SLOT=[PKI_SYSTEMD_SERVICENAME]
 PKI_TMPDIR_SLOT=[PKI_TMPDIR]
diff --git a/base/server/etc/default.cfg b/base/server/etc/default.cfg
index d8ca7fe..97b61ca 100644
--- a/base/server/etc/default.cfg
+++ b/base/server/etc/default.cfg
@@ -367,10 +367,10 @@ pki_ca_signing_signing_algorithm=SHA256withRSA
 pki_ca_signing_subject_dn=cn=CA Signing Certificate,o=%(pki_security_domain_name)s
 pki_ca_signing_token=Internal Key Storage Token
 pki_external=False
-pki_external_ca_cert_chain_path=
-pki_external_ca_cert_path=
-pki_external_csr_path=
+pki_external_csr_path=%(pki_instance_configuration_path)s/ca_signing.csr
 pki_external_step_two=False
+pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
+pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
 pki_import_admin_cert=False
 pki_ocsp_signing_key_algorithm=SHA256withRSA
 pki_ocsp_signing_key_size=2048
@@ -420,11 +420,33 @@ pki_subsystem_profiles_path=%(pki_subsystem_path)s/profiles
 ##  KRA Configuration:                                                       ##
 ##                                                                           ##
 ##  Values in this section are common to KRA subsystems                      ##
-##  including 'PKI KRAs' and 'Cloned KRAs', and contain                      ##
+##  including 'PKI KRAs', 'Cloned KRAs', and 'Stand-alone KRAs' and contain  ##
 ##  required information which MAY be overridden by users as necessary.      ##
+##                                                                           ##
+##      STAND-ALONE KRAs:  To specify a 'Stand-alone KRA', change the value  ##
+##                         of 'pki_standalone' from 'False' to 'True', and   ##
+##                         specify the various 'pki_external' parameters     ##
+##                         as appropriate.                                   ##
+##                                                                           ##
 ###############################################################################
 [KRA]
 pki_import_admin_cert=True
+pki_standalone=False
+pki_external_admin_csr_path=%(pki_instance_configuration_path)s/kra_admin.csr
+pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/kra_audit_signing.csr
+pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/kra_sslserver.csr
+pki_external_storage_csr_path=%(pki_instance_configuration_path)s/kra_storage.csr
+pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/kra_subsystem.csr
+pki_external_transport_csr_path=%(pki_instance_configuration_path)s/kra_transport.csr
+pki_external_step_two=False
+pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
+pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
+pki_external_admin_cert_path=%(pki_instance_configuration_path)s/kra_admin.cert
+pki_external_audit_signing_cert_path=%(pki_instance_configuration_path)s/kra_audit_signing.cert
+pki_external_sslserver_cert_path=%(pki_instance_configuration_path)s/kra_sslserver.cert
+pki_external_storage_cert_path=%(pki_instance_configuration_path)s/kra_storage.cert
+pki_external_subsystem_cert_path=%(pki_instance_configuration_path)s/kra_subsystem.cert
+pki_external_transport_cert_path=%(pki_instance_configuration_path)s/kra_transport.cert
 pki_storage_key_algorithm=SHA256withRSA
 pki_storage_key_size=2048
 pki_storage_key_type=rsa
@@ -466,11 +488,32 @@ pki_source_transportcert_profile=%(pki_source_conf_path)s/transportCert.profile
 ##  OCSP Configuration:                                                      ##
 ##                                                                           ##
 ##  Values in this section are common to OCSP subsystems                     ##
-##  including 'PKI OCSPs' and 'Cloned OCSPs', and contain                    ##
-##  required information which MAY be overridden by users as necessary.      ##
+##  including 'PKI OCSPs', 'Cloned OCSPs', and 'Stand-alone OCSPs' and       ##
+##  contain required information which MAY be overridden by users as         ##
+##  necessary.                                                               ##
+##                                                                           ##
+##      STAND-ALONE OCSPs:  To specify a 'Stand-alone OCSP', change the      ##
+##                          value of 'pki_standalone' from 'False' to        ##
+##                          'True', and specify the various 'pki_external'   ##
+##                          parameters as appropriate.                       ##
+##                                                                           ##
 ###############################################################################
 [OCSP]
 pki_import_admin_cert=True
+pki_standalone=False
+pki_external_admin_csr_path=
+pki_external_audit_signing_csr_path=
+pki_external_signing_csr_path=
+pki_external_sslserver_csr_path=
+pki_external_subsystem_csr_path=
+pki_external_step_two=False
+pki_external_ca_cert_chain_path=
+pki_external_ca_cert_path=
+pki_external_admin_cert_path=
+pki_external_audit_signing_cert_path=
+pki_external_signing_cert_path=
+pki_external_sslserver_cert_path=
+pki_external_subsystem_cert_path=
 pki_ocsp_signing_key_algorithm=SHA256withRSA
 pki_ocsp_signing_key_size=2048
 pki_ocsp_signing_key_type=rsa
diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py
index 9257cbf..033ff29 100644
--- a/base/server/python/pki/server/deployment/pkihelper.py
+++ b/base/server/python/pki/server/deployment/pkihelper.py
@@ -518,11 +518,17 @@ class ConfigurationFile:
                     raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_clone_pkcs12_password",
                                                                                          self.master_dict['pki_user_deployment_cfg']))
             # Verify existence of Security Domain Password
-            # (ONLY for Clones, KRA, OCSP, TKS, TPS, or Subordinate CA
+            # (ONLY for non-Stand-alone PKI KRA, non-Standalone PKI OCSP,
+            #  PKI TKS, PKI TPS, Clones, or Subordinate CA
             #  that will be automatically configured)
-            if config.str2bool(self.master_dict['pki_clone']) or\
-               not self.master_dict['pki_subsystem'] == "CA" or\
-               config.str2bool(self.master_dict['pki_subordinate']):
+            if ((self.master_dict['pki_subsystem'] == "KRA" or
+                 self.master_dict['pki_subsystem'] == "OCSP") and
+                not config.str2bool(self.master_dict['pki_standalone'])) or\
+               self.master_dict['pki_subsystem'] == "TKS" or\
+               self.master_dict['pki_subsystem'] == "TPS" or\
+               config.str2bool(self.master_dict['pki_clone']) or\
+               (self.master_dict['pki_subsystem'] == "CA" and
+                config.str2bool(self.master_dict['pki_subordinate'])):
                 if not config.str2bool(self.master_dict['pki_skip_configuration']):
                     if not self.master_dict.has_key('pki_security_domain_password') or\
                        not len(self.master_dict['pki_security_domain_password']):
@@ -601,8 +607,10 @@ class ConfigurationFile:
                         "pki_ds_base_dn",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_ds_base_dn",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_ds_base_dn",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_ds_ldap_port') or\
                    not len(self.master_dict['pki_ds_ldap_port']):
                     # FUTURE:  Check for unused port value
@@ -613,8 +621,10 @@ class ConfigurationFile:
                         "pki_ds_ldap_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_ds_ldap_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_ds_ldap_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_ds_ldaps_port') or\
                    not len(self.master_dict['pki_ds_ldaps_port']):
                     # FUTURE:  Check for unused port value
@@ -625,8 +635,10 @@ class ConfigurationFile:
                         "pki_ds_ldaps_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_ds_ldaps_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_ds_ldaps_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 # NOTE:  Although this will be checked prior to getting to
                 #        this method, this clone's 'pki_instance_name' MUST
                 #        be different from the master's 'pki_instance_name'
@@ -642,8 +654,10 @@ class ConfigurationFile:
                         "pki_ajp_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_ajp_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_ajp_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_http_port') or\
                    not len(self.master_dict['pki_http_port']):
                     # FUTURE:  Check for unused port value
@@ -654,8 +668,10 @@ class ConfigurationFile:
                         "pki_http_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_http_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_http_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_https_port') or\
                    not len(self.master_dict['pki_https_port']):
                     # FUTURE:  Check for unused port value
@@ -666,8 +682,10 @@ class ConfigurationFile:
                         "pki_https_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_https_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_https_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_tomcat_server_port') or\
                    not len(self.master_dict['pki_tomcat_server_port']):
                     # FUTURE:  Check for unused port value
@@ -678,8 +696,10 @@ class ConfigurationFile:
                         "pki_tomcat_server_port",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_tomcat_server_port",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_tomcat_server_port",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_clone_pkcs12_path') or\
                    not len(self.master_dict['pki_clone_pkcs12_path']):
                     config.pki_log.error(
@@ -687,14 +707,17 @@ class ConfigurationFile:
                         "pki_clone_pkcs12_path",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_clone_pkcs12_path",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_clone_pkcs12_path",
+                             self.master_dict['pki_user_deployment_cfg']))
                 elif not os.path.isfile(self.master_dict['pki_clone_pkcs12_path']):
                     config.pki_log.error(
                         log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
                         self.master_dict['pki_clone_pkcs12_path'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % "pki_clone_pkcs12_path")
+                    raise Exception(log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 %
+                                    "pki_clone_pkcs12_path")
                 if not self.master_dict.has_key('pki_clone_replication_security') or\
                    not len(self.master_dict['pki_clone_replication_security']):
                     config.pki_log.error(
@@ -702,8 +725,10 @@ class ConfigurationFile:
                         "pki_clone_replication_security",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_clone_replication_security",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_clone_replication_security",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not self.master_dict.has_key('pki_clone_uri') or\
                    not len(self.master_dict['pki_clone_uri']):
                     config.pki_log.error(
@@ -711,8 +736,10 @@ class ConfigurationFile:
                         "pki_clone_uri",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_clone_uri",
-                                                                                         self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_clone_uri",
+                             self.master_dict['pki_user_deployment_cfg']))
             elif self.master_dict['pki_subsystem'] == "CA" and\
                  config.str2bool(self.master_dict['pki_external']):
                 if not self.master_dict.has_key('pki_external_step_two') or\
@@ -722,8 +749,10 @@ class ConfigurationFile:
                         "pki_external_step_two",
                         self.master_dict['pki_user_deployment_cfg'],
                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_extrenal_step_two",
-                                                                                          self.master_dict['pki_user_deployment_cfg']))
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_external_step_two",
+                             self.master_dict['pki_user_deployment_cfg']))
                 if not config.str2bool(self.master_dict['pki_external_step_two']):
                     # External CA (Step 1)
                     if not self.master_dict.has_key('pki_external_csr_path') or\
@@ -733,15 +762,17 @@ class ConfigurationFile:
                             "pki_external_csr_path",
                             self.master_dict['pki_user_deployment_cfg'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_extrenal_csr_path",
-                                                                                              self.master_dict['pki_user_deployment_cfg']))
-                    elif os.path.exists(self.master_dict['pki_external_csr_path']) and\
-                         not os.path.isfile(self.master_dict['pki_external_csr_path']):
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_csr_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif os.path.exists(self.master_dict['pki_external_csr_path']):
                         config.pki_log.error(
-                            log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
+                            log.PKI_FILE_ALREADY_EXISTS_1,
                             self.master_dict['pki_external_csr_path'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % "pki_extrenal_csr_path")
+                        raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                        "pki_external_csr_path")
                 else:
                     # External CA (Step 2)
                     if not self.master_dict.has_key('pki_external_ca_cert_chain_path') or\
@@ -751,17 +782,20 @@ class ConfigurationFile:
                             "pki_external_ca_cert_chain_path",
                             self.master_dict['pki_user_deployment_cfg'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_extrenal_ca_cert_chain_path",
-                                                                                              self.master_dict['pki_user_deployment_cfg']))
-                    elif os.path.exists(
-                                 self.master_dict['pki_external_ca_cert_chain_path']) and\
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_ca_cert_chain_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(
+                                 self.master_dict['pki_external_ca_cert_chain_path']) or\
                          not os.path.isfile(
                                  self.master_dict['pki_external_ca_cert_chain_path']):
                         config.pki_log.error(
-                            log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
                             self.master_dict['pki_external_ca_cert_chain_path'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % "pki_extrenal_ca_cert_chain_path")
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_ca_cert_chain_path")
                     if not self.master_dict.has_key('pki_external_ca_cert_path') or\
                        not len(self.master_dict['pki_external_ca_cert_path']):
                         config.pki_log.error(
@@ -769,16 +803,386 @@ class ConfigurationFile:
                             "pki_external_ca_cert_path",
                             self.master_dict['pki_user_deployment_cfg'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % ("pki_extrenal_ca_cert_path",
-                                                                                              self.master_dict['pki_user_deployment_cfg']))
-                    elif os.path.exists(self.master_dict['pki_external_ca_cert_path']) and\
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_ca_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_ca_cert_path']) or\
                          not os.path.isfile(
                                  self.master_dict['pki_external_ca_cert_path']):
                         config.pki_log.error(
-                            log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
                             self.master_dict['pki_external_ca_cert_path'],
                             extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % "pki_extrenal_ca_cert_path")
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_ca_cert_path")
+            elif not config.str2bool(self.master_dict['pki_skip_configuration']) and\
+                 ((self.master_dict['pki_subsystem'] == "KRA" or
+                   self.master_dict['pki_subsystem'] == "OCSP") and
+                  config.str2bool(self.master_dict['pki_standalone'])):
+                if not self.master_dict.has_key('pki_external_step_two') or\
+                   not len(self.master_dict['pki_external_step_two']):
+                    config.pki_log.error(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                        "pki_external_step_two",
+                        self.master_dict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                            ("pki_external_step_two",
+                             self.master_dict['pki_user_deployment_cfg']))
+                if not config.str2bool(self.master_dict['pki_external_step_two']):
+                    # Stand-alone PKI KRA/OCSP Admin CSR
+                    # (External CA Step 1)
+                    if not self.master_dict.has_key('pki_external_admin_csr_path') or\
+                       not len(self.master_dict['pki_external_admin_csr_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_admin_csr_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_admin_csr_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif os.path.exists(self.master_dict['pki_external_admin_csr_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1,
+                            self.master_dict['pki_external_admin_csr_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                        "pki_external_admin_csr_path")
+                    # Stand-alone PKI KRA/OCSP Audit Signing CSR
+                    # (External CA Step 1)
+                    if not self.master_dict.has_key('pki_external_audit_signing_csr_path') or\
+                       not len(self.master_dict['pki_external_audit_signing_csr_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_audit_signing_csr_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_audit_signing_csr_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif os.path.exists(self.master_dict['pki_external_audit_signing_csr_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1,
+                            self.master_dict['pki_external_audit_signing_csr_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                        "pki_external_audit_signing_csr_path")
+                    # Stand-alone PKI KRA/OCSP SSL Server CSR
+                    # (External CA Step 1)
+                    if not self.master_dict.has_key('pki_external_sslserver_csr_path') or\
+                       not len(self.master_dict['pki_external_sslserver_csr_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_sslserver_csr_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_sslserver_csr_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif os.path.exists(self.master_dict['pki_external_sslserver_csr_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1,
+                            self.master_dict['pki_external_sslserver_csr_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                        "pki_external_sslserver_csr_path")
+                    # Stand-alone PKI KRA/OCSP Subsystem CSR
+                    # (External CA Step 1)
+                    if not self.master_dict.has_key('pki_external_subsystem_csr_path') or\
+                       not len(self.master_dict['pki_external_subsystem_csr_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_subsystem_csr_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_subsystem_csr_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif os.path.exists(self.master_dict['pki_external_subsystem_csr_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1,
+                            self.master_dict['pki_external_subsystem_csr_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                        "pki_external_subsystem_csr_path")
+                    # Stand-alone PKI KRA CSRs
+                    if self.master_dict['pki_subsystem'] == "KRA":
+                        # Stand-alone PKI KRA Storage CSR
+                        # (External CA Step 1)
+                        if not self.master_dict.has_key('pki_external_storage_csr_path') or\
+                           not len(self.master_dict['pki_external_storage_csr_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_storage_csr_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_storage_csr_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif os.path.exists(self.master_dict['pki_external_storage_csr_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_ALREADY_EXISTS_1,
+                                self.master_dict['pki_external_storage_csr_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                            "pki_external_storage_csr_path")
+                        # Stand-alone PKI KRA Transport CSR
+                        # (External CA Step 1)
+                        if not self.master_dict.has_key('pki_external_transport_csr_path') or\
+                           not len(self.master_dict['pki_external_transport_csr_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_transport_csr_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_transport_csr_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif os.path.exists(self.master_dict['pki_external_transport_csr_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_ALREADY_EXISTS_1,
+                                self.master_dict['pki_external_transport_csr_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                            "pki_external_transport_csr_path")
+                    # Stand-alone PKI OCSP CSRs
+                    if self.master_dict['pki_subsystem'] == "OCSP":
+                        # Stand-alone PKI OCSP OCSP Signing CSR
+                        # (External CA Step 1)
+                        if not self.master_dict.has_key('pki_external_signing_csr_path') or\
+                           not len(self.master_dict['pki_external_signing_csr_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_signing_csr_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_signing_csr_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif os.path.exists(self.master_dict['pki_external_signing_csr_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_ALREADY_EXISTS_1,
+                                self.master_dict['pki_external_signing_csr_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 %
+                                            "pki_external_signing_csr_path")
+                else:
+                    # Stand-alone PKI KRA/OCSP External CA Certificate Chain
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_ca_cert_chain_path') or\
+                       not len(self.master_dict['pki_external_ca_cert_chain_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_ca_cert_chain_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_ca_cert_chain_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(
+                                 self.master_dict['pki_external_ca_cert_chain_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_ca_cert_chain_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_ca_cert_chain_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_ca_cert_chain_path")
+                    # Stand-alone PKI KRA/OCSP External CA Certificate
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_ca_cert_path') or\
+                       not len(self.master_dict['pki_external_ca_cert_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_ca_cert_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_ca_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_ca_cert_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_ca_cert_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_ca_cert_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_ca_cert_path")
+                    # Stand-alone PKI KRA/OCSP Admin Certificate
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_admin_cert_path') or\
+                       not len(self.master_dict['pki_external_admin_cert_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_admin_cert_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_admin_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_admin_cert_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_admin_cert_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_admin_cert_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_admin_cert_path")
+                    # Stand-alone PKI KRA/OCSP Audit Signing Certificate
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_audit_signing_cert_path') or\
+                       not len(self.master_dict['pki_external_audit_signing_cert_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_audit_signing_cert_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_audit_signing_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_audit_signing_cert_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_audit_signing_cert_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_audit_signing_cert_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_audit_signing_cert_path")
+                    # Stand-alone PKI KRA/OCSP SSL Server Certificate
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_sslserver_cert_path') or\
+                       not len(self.master_dict['pki_external_sslserver_cert_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_sslserver_cert_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_sslserver_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_sslserver_cert_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_sslserver_cert_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_sslserver_cert_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_sslserver_cert_path")
+                    # Stand-alone PKI KRA/OCSP Subsystem Certificate
+                    # (External CA Step 2)
+                    if not self.master_dict.has_key('pki_external_subsystem_cert_path') or\
+                       not len(self.master_dict['pki_external_subsystem_cert_path']):
+                        config.pki_log.error(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                            "pki_external_subsystem_cert_path",
+                            self.master_dict['pki_user_deployment_cfg'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                ("pki_external_subsystem_cert_path",
+                                 self.master_dict['pki_user_deployment_cfg']))
+                    elif not os.path.exists(self.master_dict['pki_external_subsystem_cert_path']) or\
+                         not os.path.isfile(
+                                 self.master_dict['pki_external_subsystem_cert_path']):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            self.master_dict['pki_external_subsystem_cert_path'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                        "pki_external_subsystem_cert_path")
+                    # Stand-alone PKI KRA Certificates
+                    if self.master_dict['pki_subsystem'] == "KRA":
+                        # Stand-alone PKI KRA Storage Certificate
+                        # (External CA Step 2)
+                        if not self.master_dict.has_key('pki_external_storage_cert_path') or\
+                           not len(self.master_dict['pki_external_storage_cert_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_storage_cert_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_storage_cert_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif not os.path.exists(self.master_dict['pki_external_storage_cert_path']) or\
+                             not os.path.isfile(
+                                     self.master_dict['pki_external_storage_cert_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                                self.master_dict['pki_external_storage_cert_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                    "pki_external_storage_cert_path")
+                        # Stand-alone PKI KRA Transport Certificate
+                        # (External CA Step 2)
+                        if not self.master_dict.has_key('pki_external_transport_cert_path') or\
+                           not len(self.master_dict['pki_external_transport_cert_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_transport_cert_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_transport_cert_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif not os.path.exists(self.master_dict['pki_external_transport_cert_path']) or\
+                             not os.path.isfile(
+                                     self.master_dict['pki_external_transport_cert_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                                self.master_dict['pki_external_transport_cert_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                    "pki_external_transport_cert_path")
+                    # Stand-alone PKI OCSP Certificates
+                    if self.master_dict['pki_subsystem'] == "OCSP":
+                        # Stand-alone PKI OCSP OCSP Signing Certificate
+                        # (External CA Step 2)
+                        if not self.master_dict.has_key('pki_external_signing_cert_path') or\
+                           not len(self.master_dict['pki_external_signing_cert_path']):
+                            config.pki_log.error(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                                "pki_external_signing_cert_path",
+                                self.master_dict['pki_user_deployment_cfg'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                                    ("pki_external_signing_cert_path",
+                                     self.master_dict['pki_user_deployment_cfg']))
+                        elif not os.path.exists(self.master_dict['pki_external_signing_cert_path']) or\
+                             not os.path.isfile(
+                                     self.master_dict['pki_external_signing_cert_path']):
+                            config.pki_log.error(
+                                log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                                self.master_dict['pki_external_signing_cert_path'],
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            raise Exception(
+                                log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                                    "pki_external_signing_cert_path")
         return
 
     def populate_non_default_ports(self):
@@ -3112,35 +3516,117 @@ class ConfigClient:
                    not config.str2bool(self.master_dict['pki_external_step_two']):
                     # External CA Step 1
                     if cdata['tag'].lower() == "signing":
-                        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + \
-                            " " + cdata['request'],
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-
                         # Save 'External CA Signing Certificate' CSR (Step 1)
                         config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE + \
                             " '" + self.master_dict['pki_external_csr_path'] + "'",
                             extra=config.PKI_INDENTATION_LEVEL_2)
+                        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + \
+                            "\n" + cdata['request'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
                         self.deployer.directory.create(
                             os.path.dirname(self.master_dict['pki_external_csr_path']))
                         with open(self.master_dict['pki_external_csr_path'], "w") as f:
                             f.write(cdata['request'])
                         return
+                elif ((self.master_dict['pki_subsystem'] == "KRA" or
+                       self.master_dict['pki_subsystem'] == "OCSP") and
+                      config.str2bool(self.master_dict['pki_standalone'])) and\
+                     not config.str2bool(self.master_dict['pki_external_step_two']):
+                    # PKI KRA/OCSP (External CA Step 1)
+                    if cdata['tag'].lower() == "audit_signing":
+                        # Save PKI KRA/OCSP 'Audit Signing Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1 + \
+                            " '" + self.master_dict['pki_external_audit_signing_csr_path'] + "'",
+                            self.master_dict['pki_subsystem'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_audit_signing_csr_path']))
+                        with open(self.master_dict['pki_external_audit_signing_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    elif cdata['tag'].lower() == "signing":
+                        # Save PKI OCSP 'OCSP Signing Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING + \
+                            " '" + self.master_dict['pki_external_signing_csr_path'] + "'",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_signing_csr_path']))
+                        with open(self.master_dict['pki_external_signing_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    elif cdata['tag'].lower() == "sslserver":
+                        # Save PKI KRA/OCSP 'SSL Server Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1 + \
+                            " '" + self.master_dict['pki_external_sslserver_csr_path'] + "'",
+                            self.master_dict['pki_subsystem'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_sslserver_csr_path']))
+                        with open(self.master_dict['pki_external_sslserver_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    elif cdata['tag'].lower() == "storage":
+                        # Save PKI KRA 'Storage Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE + \
+                            " '" + self.master_dict['pki_external_storage_csr_path'] + "'",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_storage_csr_path']))
+                        with open(self.master_dict['pki_external_storage_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    elif cdata['tag'].lower() == "subsystem":
+                        # Save PKI KRA/OCSP 'Subsystem Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1 + \
+                            " '" + self.master_dict['pki_external_subsystem_csr_path'] + "'",
+                            self.master_dict['pki_subsystem'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_subsystem_csr_path']))
+                        with open(self.master_dict['pki_external_subsystem_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    elif cdata['tag'].lower() == "transport":
+                        # Save PKI KRA 'Transport Certificate' CSR
+                        # (External CA Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT + \
+                            " '" + self.master_dict['pki_external_transport_csr_path'] + "'",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_transport_csr_path']))
+                        with open(self.master_dict['pki_external_transport_csr_path'], "w") as f:
+                            f.write(cdata['request'])
+                    # Print this certificate request
+                    config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + \
+                        "\n" + cdata['request'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
                 else:
                     config.pki_log.debug(log.PKI_CONFIG_CDATA_TAG + \
                                            " " + cdata['tag'],
                                          extra=config.PKI_INDENTATION_LEVEL_2)
                     config.pki_log.debug(log.PKI_CONFIG_CDATA_CERT + \
-                                           " " + cdata['cert'],
+                                           "\n" + cdata['cert'],
                                          extra=config.PKI_INDENTATION_LEVEL_2)
                     config.pki_log.debug(log.PKI_CONFIG_CDATA_REQUEST + \
-                                           " " + cdata['request'],
+                                           "\n" + cdata['request'],
                                          extra=config.PKI_INDENTATION_LEVEL_2)
 
             # Cloned PKI subsystems do not return an Admin Certificate
-            if not config.str2bool(self.master_dict['pki_clone']) and \
-               not config.str2bool(self.master_dict['pki_import_admin_cert']):
-                admin_cert = response['adminCert']['cert']
-                self.process_admin_cert(admin_cert)
+            if not config.str2bool(self.master_dict['pki_clone']):
+                if ((self.master_dict['pki_subsystem'] == "KRA" or
+                     self.master_dict['pki_subsystem'] == "OCSP") and
+                    config.str2bool(self.master_dict['pki_standalone'])):
+                    if not config.str2bool(self.master_dict['pki_external_step_two']):
+                        # NOTE:  Do nothing for Stand-alone PKI KRA/OCSP 
+                        #        (External CA Step 1) as this has already
+                        #        been addressed in 'set_admin_parameters()'
+                        pass
+                    else:
+                        admin_cert = response['adminCert']['cert']
+                        self.process_admin_cert(admin_cert)
+                elif not config.str2bool(self.master_dict['pki_import_admin_cert']):
+                    admin_cert = response['adminCert']['cert']
+                    self.process_admin_cert(admin_cert)
 
         except Exception, e:
             if hasattr(e, 'response'):
@@ -3159,14 +3645,15 @@ class ConfigClient:
 
     def process_admin_cert(self, admin_cert):
         config.pki_log.debug(log.PKI_CONFIG_RESPONSE_ADMIN_CERT + \
-                             " " + admin_cert,
+                             "\n" + admin_cert,
                              extra=config.PKI_INDENTATION_LEVEL_2)
 
         # Store the Administration Certificate in a file
         admin_cert_file = self.master_dict['pki_client_admin_cert']
         admin_cert_bin_file = admin_cert_file + ".der"
-        config.pki_log.debug(log.PKI_CONFIG_ADMIN_CERT_SAVE + \
-                               " '" + admin_cert_file + "'",
+        config.pki_log.debug(log.PKI_CONFIG_ADMIN_CERT_SAVE_1 + \
+                             " '" + admin_cert_file + "'",
+                             self.master_dict['pki_subsystem_name'],
                              extra=config.PKI_INDENTATION_LEVEL_2)
         with open(admin_cert_file, "w") as f:
             f.write(admin_cert)
@@ -3240,10 +3727,16 @@ class ConfigClient:
         if self.master_dict['pki_subsystem'] != "CA" or\
            config.str2bool(self.master_dict['pki_clone']) or\
            config.str2bool(self.master_dict['pki_subordinate']):
-            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
-            # Subordinate CA
-            self.set_existing_security_domain(data)
+            if ((self.master_dict['pki_subsystem'] == "KRA" or
+                 self.master_dict['pki_subsystem'] == "OCSP") and
+                config.str2bool(self.master_dict['pki_standalone'])):
+                # Stand-alone PKI KRA/OCSP
+                self.set_new_security_domain(data)
+            else:
+                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+                # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
+                # Subordinate CA
+                self.set_existing_security_domain(data)
         else:
             # PKI CA or External CA
             self.set_new_security_domain(data)
@@ -3276,35 +3769,60 @@ class ConfigClient:
         systemCerts = []
 
         # Create 'CA Signing Certificate'
-        if self.master_dict['pki_subsystem'] == "CA":
-            if not config.str2bool(self.master_dict['pki_clone']):
-                cert1 = self.create_system_cert("ca_signing")
-                cert1.signingAlgorithm = \
-                    self.master_dict['pki_ca_signing_signing_algorithm']
+        if not config.str2bool(self.master_dict['pki_clone']):
+            if (self.master_dict['pki_subsystem'] == "CA" or
+                ((self.master_dict['pki_subsystem'] == "KRA" or
+                  self.master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(self.master_dict['pki_standalone']))):
+                if self.master_dict['pki_subsystem'] == "CA":
+                    # PKI CA or Subordinate CA
+                    cert1 = self.create_system_cert("ca_signing")
+                    cert1.signingAlgorithm = \
+                        self.master_dict['pki_ca_signing_signing_algorithm']
                 if config.str2bool(self.master_dict['pki_external_step_two']):
+                    if not self.master_dict['pki_subsystem'] == "CA":
+                        # Stand-alone PKI KRA/OCSP (External CA Step 2)
+                        cert1 = pki.system.SystemCertData()
+                        cert1.tag = self.master_dict['pki_ca_signing_tag']
+                    # PKI CA or Stand-alone PKI KRA/OCSP (External CA Step 2)
                     # Load the 'External CA Signing Certificate' (Step 2)
-                    print(
-                        log.PKI_CONFIG_EXTERNAL_CA_LOAD + " " + \
-                        "'" + self.master_dict['pki_external_ca_cert_path'] + "'")
-                    with open(self.master_dict['pki_external_ca_cert_path']) as f:
-                        external_cert = f.read()
-                    cert1.cert = external_cert
-
+                    config.pki_log.info(
+                        log.PKI_CONFIG_EXTERNAL_CA_LOAD + " '" +
+                        self.master_dict['pki_external_ca_cert_path'] + "'",
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    with open(self.master_dict['pki_external_ca_cert_path'], "r") as f:
+                        cert1.cert = f.read()
                     # Load the 'External CA Signing Certificate Chain' (Step 2)
-                    print(
-                        log.PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD + " " + \
-                        "'" + self.master_dict['pki_external_ca_cert_chain_path'] + \
-                        "'")
-                    with open(self.master_dict['pki_external_ca_cert_chain_path']) as f:
-                        external_cert_chain = f.read()
-
-                    cert1.certChain = external_cert_chain
-                systemCerts.append(cert1)
+                    config.pki_log.info(
+                        log.PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD + " '" +
+                        self.master_dict['pki_external_ca_cert_chain_path'] +
+                        "'", extra=config.PKI_INDENTATION_LEVEL_2)
+                    with open(self.master_dict['pki_external_ca_cert_chain_path'], "r") as f:
+                        cert1.certChain = f.read()
+                    systemCerts.append(cert1)
+                elif self.master_dict['pki_subsystem'] == "CA":
+                    systemCerts.append(cert1)
 
         # Create 'OCSP Signing Certificate'
         if not config.str2bool(self.master_dict['pki_clone']):
-            if self.master_dict['pki_subsystem'] == "CA" or\
-               self.master_dict['pki_subsystem'] == "OCSP":
+            if ((self.master_dict['pki_subsystem'] == "OCSP" and
+                 config.str2bool(self.master_dict['pki_standalone'])) and
+                config.str2bool(self.master_dict['pki_external_step_two'])):
+                # Stand-alone PKI OCSP (External CA Step 2)
+                cert2 = self.create_system_cert("ocsp_signing")
+                # Load the PKI OCSP 'OCSP Signing Certificate'
+                # for a Stand-alone PKI OCSP (External CA Step 2)
+                config.pki_log.info(
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING + " '" +
+                    self.master_dict['pki_external_signing_cert_path'] + "'",
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(self.master_dict['pki_external_signing_cert_path'], "r") as f:
+                    cert2.cert = f.read()
+                cert2.signingAlgorithm = \
+                    self.master_dict['pki_ocsp_signing_signing_algorithm']
+                systemCerts.append(cert2)
+            elif self.master_dict['pki_subsystem'] == "CA" or\
+                 self.master_dict['pki_subsystem'] == "OCSP":
                 # External CA, Subordinate CA, PKI CA, or PKI OCSP
                 cert2 = self.create_system_cert("ocsp_signing")
                 cert2.signingAlgorithm = \
@@ -3315,9 +3833,25 @@ class ConfigClient:
         # all subsystems
 
         # create new sslserver cert only if this is a new instance
-        cert3 = None
         system_list = self.deployer.instance.tomcat_instance_subsystems()
-        if len(system_list) >= 2:
+        if (((self.master_dict['pki_subsystem'] == "KRA" or
+              self.master_dict['pki_subsystem'] == "OCSP") and
+             config.str2bool(self.master_dict['pki_standalone'])) and
+            config.str2bool(self.master_dict['pki_external_step_two'])):
+            # Stand-alone PKI KRA/OCSP (External CA Step 2)
+            cert3 = self.create_system_cert("ssl_server")
+            # Load the PKI KRA/OCSP 'SSL Server Certificate'
+            # for a Stand-alone PKI KRA/OCSP (External CA Step 2)
+            config.pki_log.info(
+                log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1 + " '" +
+                self.master_dict['pki_external_sslserver_cert_path'] + "'",
+                self.master_dict['pki_subsystem'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            with open(self.master_dict['pki_external_sslserver_cert_path'], "r") as f:
+                cert3.cert = f.read()
+            systemCerts.append(cert3)
+        elif len(system_list) >= 2:
+            # Existing PKI Instance
             data.generateServerCert = "false"
             for subsystem in system_list:
                 dst = self.master_dict['pki_instance_path'] + '/conf/' + \
@@ -3325,30 +3859,98 @@ class ConfigClient:
                 if subsystem != self.master_dict['pki_subsystem'] and \
                    os.path.exists(dst):
                     cert3 = self.retrieve_existing_server_cert(dst)
+                    systemCerts.append(cert3)
                     break
         else:
+            # PKI CA, PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
+            # Subordinate CA, or External CA
             cert3 = self.create_system_cert("ssl_server")
-        systemCerts.append(cert3)
+            systemCerts.append(cert3)
 
         # Create 'Subsystem Certificate'
         if not config.str2bool(self.master_dict['pki_clone']):
-            cert4 = self.create_system_cert("subsystem")
-            systemCerts.append(cert4)
+            if (((self.master_dict['pki_subsystem'] == "KRA" or
+                  self.master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(self.master_dict['pki_standalone'])) and
+                config.str2bool(self.master_dict['pki_external_step_two'])):
+                # Stand-alone PKI KRA/OCSP (External CA Step 2)
+                cert4 = self.create_system_cert("subsystem")
+                # Load the PKI KRA/OCSP 'Subsystem Certificate'
+                # for a Stand-alone PKI KRA/OCSP (External CA Step 2)
+                config.pki_log.info(
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1 + " '" +
+                    self.master_dict['pki_external_subsystem_cert_path'] + "'",
+                    self.master_dict['pki_subsystem'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(self.master_dict['pki_external_subsystem_cert_path'], "r") as f:
+                    cert4.cert = f.read()
+                systemCerts.append(cert4)
+            else:
+                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+                # Subordinate CA, or External CA
+                cert4 = self.create_system_cert("subsystem")
+                systemCerts.append(cert4)
 
         # Create 'Audit Signing Certificate'
         if not config.str2bool(self.master_dict['pki_clone']):
-            if self.master_dict['pki_subsystem'] != "RA":
+            if (((self.master_dict['pki_subsystem'] == "KRA" or
+                  self.master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(self.master_dict['pki_standalone'])) and
+                config.str2bool(self.master_dict['pki_external_step_two'])):
+                # Stand-alone PKI KRA/OCSP (External CA Step 2)
+                cert5 = self.create_system_cert("audit_signing")
+                # Load the PKI KRA/OCSP 'Audit Signing Certificate'
+                # for a Stand-alone PKI KRA/OCSP (External CA Step 2)
+                config.pki_log.info(
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1 +
+                    " '" +
+                    self.master_dict['pki_external_audit_signing_cert_path'] +
+                    "'", self.master_dict['pki_subsystem'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(self.master_dict['pki_external_audit_signing_cert_path'], "r") as f:
+                    cert5.cert = f.read()
+                cert5.signingAlgorithm = \
+                    self.master_dict['pki_audit_signing_signing_algorithm']
+                systemCerts.append(cert5)
+            elif self.master_dict['pki_subsystem'] != "RA":
                 cert5 = self.create_system_cert("audit_signing")
                 cert5.signingAlgorithm = \
                     self.master_dict['pki_audit_signing_signing_algorithm']
                 systemCerts.append(cert5)
 
-        # Create DRM Transport and storage Certificates
+        # Create 'DRM Transport Certificate' and 'DRM Storage Certificate'
         if not config.str2bool(self.master_dict['pki_clone']):
-            if self.master_dict['pki_subsystem'] == "KRA":
+            if ((self.master_dict['pki_subsystem'] == "KRA" and
+                 config.str2bool(self.master_dict['pki_standalone'])) and
+                config.str2bool(self.master_dict['pki_external_step_two'])):
+                # Stand-alone PKI KRA Transport Certificate (External CA Step 2)
                 cert6 = self.create_system_cert("transport")
+                # Load the PKI KRA 'Transport Certificate'
+                # for a Stand-alone PKI KRA (External CA Step 2)
+                config.pki_log.info(
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT + " '" +
+                    self.master_dict['pki_external_transport_cert_path'] + "'",
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(self.master_dict['pki_external_transport_cert_path'], "r") as f:
+                    cert6.cert = f.read()
                 systemCerts.append(cert6)
-
+                # Stand-alone PKI KRA Storage Certificate (External CA Step 2)
+                cert7 = self.create_system_cert("storage")
+                # Load the PKI KRA 'Storage Certificate'
+                # for a Stand-alone PKI KRA (External CA Step 2)
+                config.pki_log.info(
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE + " '" +
+                    self.master_dict['pki_external_storage_cert_path'] + "'",
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(self.master_dict['pki_external_storage_cert_path'], "r") as f:
+                    cert7.cert = f.read()
+                systemCerts.append(cert7)
+            elif self.master_dict['pki_subsystem'] == "KRA":
+                # PKI KRA Transport Certificate
+                cert6 = self.create_system_cert("transport")
+                systemCerts.append(cert6)
+                # PKI KRA Storage Certificate
                 cert7 = self.create_system_cert("storage")
                 systemCerts.append(cert7)
 
@@ -3425,10 +4027,41 @@ class ConfigClient:
         data.adminProfileID = self.master_dict['pki_admin_profile_id']
         data.adminUID = self.master_dict['pki_admin_uid']
         data.adminSubjectDN = self.master_dict['pki_admin_subject_dn']
+        if ((self.master_dict['pki_subsystem'] == "KRA" or
+             self.master_dict['pki_subsystem'] == "OCSP") and
+            config.str2bool(self.master_dict['pki_standalone'])):
+            if not config.str2bool(self.master_dict['pki_external_step_two']):
+                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' FALSE for
+                #             Stand-alone PKI KRA/OCSP (External CA Step 1)
+                self.master_dict['pki_import_admin_cert'] = "False"
+            else:
+                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' TRUE for
+                #             Stand-alone PKI KRA/OCSP (External CA Step 2)
+                self.master_dict['pki_import_admin_cert'] = "True"
         if config.str2bool(self.master_dict['pki_import_admin_cert']):
             data.importAdminCert = "true"
+            if ((self.master_dict['pki_subsystem'] == "KRA" or
+                 self.master_dict['pki_subsystem'] == "OCSP") and
+                config.str2bool(self.master_dict['pki_standalone'])):
+                # Stand-alone PKI KRA/OCSP (External CA Step 2)
+                #
+                # Copy the stand-alone PKI KRA/OCSP 'Admin Certificate'
+                # (that was previously generated via an external CA) into
+                # 'ca_admin.cert' under the specified 'pki_client_dir'
+                # stripping the certificate HEADER/FOOTER prior to saving it.
+                imported_admin_cert = ""
+                with open(self.master_dict['pki_external_admin_cert_path'], "r") as f:
+                    for line in f:
+                        if line.startswith("-----BEGIN CERTIFICATE-----"):
+                            continue
+                        elif line.startswith("-----END CERTIFICATE-----"):
+                            continue
+                        else:
+                            imported_admin_cert = imported_admin_cert + line
+                with open(self.master_dict['pki_admin_cert_file'], "w") as f:
+                    f.write(imported_admin_cert)
             # read config from file
-            with open(self.master_dict['pki_admin_cert_file']) as f:
+            with open(self.master_dict['pki_admin_cert_file'], "r") as f:
                 b64 = f.read().replace('\n', '')
             data.adminCert = b64
         else:
@@ -3466,7 +4099,44 @@ class ConfigClient:
                                          extra=config.PKI_INDENTATION_LEVEL_2)
                     raise
 
-                with open(output_file + ".asc") as f:
+                if ((self.master_dict['pki_subsystem'] == "KRA" or
+                     self.master_dict['pki_subsystem'] == "OCSP") and
+                    config.str2bool(self.master_dict['pki_standalone'])):
+                    if not config.str2bool(self.master_dict['pki_external_step_two']):
+                        # For convenience and consistency, save a copy of
+                        # the PKI KRA/OCSP 'Admin Certificate' CSR to the
+                        # specified "pki_external_admin_csr_path" location
+                        # (External CA Step 1)
+                        config.pki_log.info(
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 + \
+                            " '" + \
+                            self.master_dict['pki_external_admin_csr_path'] + \
+                            "'", self.master_dict['pki_subsystem'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        self.deployer.directory.create(
+                            os.path.dirname(self.master_dict['pki_external_admin_csr_path']))
+                        with open(self.master_dict['pki_external_admin_csr_path'], "w") as f:
+                            f.write("-----BEGIN CERTIFICATE REQUEST-----\n")
+                        admin_certreq = None
+                        with open(os.path.join(
+                                  self.master_dict['pki_client_database_dir'],
+                                  "admin_pkcs10.bin.asc"), "r") as f:
+                            admin_certreq = f.read()
+                        with open(self.master_dict['pki_external_admin_csr_path'], "a") as f:
+                            f.write(admin_certreq)
+                            f.write("-----END CERTIFICATE REQUEST-----")
+                        # Read in and print Admin certificate request
+                        with open(self.master_dict['pki_external_admin_csr_path'], "r") as f:
+                            admin_certreq = f.read()
+                        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + \
+                            "\n" + admin_certreq,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        # IMPORTANT:  ALWAYS save the client database for
+                        #             Stand-alone PKI KRA/OCSP
+                        #             (External CA Step 1)
+                        self.master_dict['pki_client_database_purge'] = "False"
+
+                with open(output_file + ".asc", "r") as f:
                     b64 = f.read().replace('\n', '')
 
                 data.adminCertRequest = b64
@@ -3481,12 +4151,16 @@ class ConfigClient:
            config.str2bool(self.master_dict['pki_external']):
             # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
             # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
-            # Subordinate CA, or External CA
+            # Subordinate CA, External CA, or Stand-alone PKI KRA/OCSP
             data.issuingCA = self.master_dict['pki_issuing_ca']
-            if self.master_dict['pki_subsystem'] == "CA"  and\
-               config.str2bool(self.master_dict['pki_external_step_two']):
-                # External CA Step 2
-                data.stepTwo = "true"
+            if (self.master_dict['pki_subsystem'] == "CA" or
+                ((self.master_dict['pki_subsystem'] == "KRA" or
+                  self.master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(self.master_dict['pki_standalone']))):
+                if (config.str2bool(self.master_dict['pki_external_step_two'])):
+                    # External CA or Stand-alone PKI KRA/OCSP
+                    # (External CA Step 2)
+                    data.stepTwo = "true"
 
     def set_tps_parameters(self, data):
         data.caUri = self.master_dict['pki_ca_uri']
diff --git a/base/server/python/pki/server/deployment/pkimessages.py b/base/server/python/pki/server/deployment/pkimessages.py
index a3be42e..0cc968d 100644
--- a/base/server/python/pki/server/deployment/pkimessages.py
+++ b/base/server/python/pki/server/deployment/pkimessages.py
@@ -57,6 +57,10 @@ PKI_VERBOSITY = \
 PKI_BADZIPFILE_ERROR_1 = "zipfile.BadZipFile:  %s!"
 PKI_CONFIGURATION_RESTART_1 = "    After configuration, the server can be "\
                               "operated by the command:\n    %s"
+PKI_CONFIGURATION_STANDALONE_1 = "      Please obtain the necessary "\
+                                 "certificates for this stand-alone %s,\n"\
+                                 "      and re-run the configuration for "\
+                                 "step two."
 PKI_CONFIGURATION_URL_1 = "    Please start the configuration by accessing:\n    %s"
 PKI_CONFIGURATION_WIZARD_RESTART_1 = "After configuration, the server can be "\
                                      "operated by the command:\n%s"
@@ -287,8 +291,8 @@ PKIHELPER_USER_ADD_DEFAULT_2 = "adding default UID '%s' for user '%s' . . ."
 PKIHELPER_USER_ADD_KEYERROR_1 = "KeyError:  pki_user %s"
 PKIHELPER_USER_ADD_UID_KEYERROR_1 = "KeyError:  pki_uid %s"
 
-PKI_CONFIG_ADMIN_CERT_SAVE = "saving Admin Certificate to file:"
-PKI_CONFIG_ADMIN_CERT_ATOB = "converting Admin Certificate to binary:"
+PKI_CONFIG_ADMIN_CERT_SAVE_1 = "saving %s Admin Certificate to file:"
+PKI_CONFIG_ADMIN_CERT_ATOB_1 = "converting %s Admin Certificate to binary:"
 PKI_CONFIG_CDATA_TAG = "tag:"
 PKI_CONFIG_CDATA_CERT = "cert:"
 PKI_CONFIG_CDATA_REQUEST = "request:"
@@ -300,7 +304,32 @@ PKI_CONFIG_EXTERNAL_CA_LOAD = "loading external CA signing certificate "\
                               "from file:"
 PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD = "loading external CA signing certificate "\
                                     "chain from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE = "loading external CA signed KRA "\
+                                            "Storage certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT = "loading external CA signed KRA "\
+                                              "Transport certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING = "loading external CA signed OCSP "\
+                                             "Signing certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1 = "loading external CA signed "\
+                                                "%s SSL Server certificate "\
+                                                "from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1 = "loading external CA signed "\
+                                                "%s Subsystem certificate "\
+                                                "from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1 = "loading external CA "\
+                                                    "signed %s Audit Signing "\
+                                                    "certificate from file:"
 PKI_CONFIG_EXTERNAL_CSR_SAVE = "saving CA Signing CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE = "saving KRA Storage CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT = "saving KRA Transport CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING = "saving OCSP Signing CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 = "saving %s Admin CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1 = "saving %s Audit Signing "\
+                                                   "CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1 = "saving %s SSL Server CSR "\
+                                               "to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1 = "saving %s Subsystem CSR "\
+                                               "to file:"
 PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION = \
     "Exception from Java Configuration Servlet:"
 PKI_CONFIG_RESPONSE_ADMIN_CERT = "adminCert:"
diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
index e7b23a6..2bc5277 100644
--- a/base/server/python/pki/server/deployment/pkiparser.py
+++ b/base/server/python/pki/server/deployment/pkiparser.py
@@ -468,10 +468,14 @@ class PKIConfigParser:
             self.pki_master_dict['pki_target_registry'] = \
                 os.path.join(self.pki_master_dict['pki_instance_registry_path'],
                              self.pki_master_dict['pki_instance_name'])
-            if self.pki_master_dict['pki_subsystem'] == "CA" and\
+            if (self.pki_master_dict['pki_subsystem'] == "CA" or
+                ((self.pki_master_dict['pki_subsystem'] == "KRA" or
+                  self.pki_master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(self.pki_master_dict['pki_standalone']))) and\
                config.str2bool(self.pki_master_dict['pki_external_step_two']):
-                # Use the 'pki_one_time_pin' established during the setup of
-                # External CA Step 1
+                # For CA (External CA Step 2) and Stand-alone PKI KRA/OCSP
+                # (External CA Step 2), use the 'pki_one_time_pin' established
+                # during the setup of (External CA Step 1)
                 if os.path.exists(self.pki_master_dict['pki_target_cs_cfg'])\
                    and\
                    os.path.isfile(self.pki_master_dict['pki_target_cs_cfg']):
@@ -732,6 +736,20 @@ class PKIConfigParser:
                         "<!--"
                     self.pki_master_dict['PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT'] = \
                         "<!--"
+                if ((self.pki_master_dict['pki_subsystem'] == "KRA" or
+                     self.pki_master_dict['pki_subsystem'] == "OCSP") and
+                    config.str2bool(self.pki_master_dict['pki_standalone'])):
+                    self.pki_master_dict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
+                        ""
+                    self.pki_master_dict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
+                        ""
+                    self.pki_master_dict['PKI_STANDALONE_SLOT'] = "true"
+                else:
+                    self.pki_master_dict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
+                        "-->"
+                    self.pki_master_dict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
+                        "<!--"
+                    self.pki_master_dict['PKI_STANDALONE_SLOT'] = "false"
                 self.pki_master_dict['PKI_TMPDIR_SLOT'] = \
                     self.pki_master_dict['pki_tomcat_tmpdir_path']
                 self.pki_master_dict['PKI_RESTEASY_LIB_SLOT'] = \
@@ -951,9 +969,16 @@ class PKIConfigParser:
                 else:
                     self.pki_master_dict['pki_security_domain_user'] = "caadmin"
 
-            if config.pki_subsystem != "CA" or\
-               config.str2bool(self.pki_master_dict['pki_clone']) or\
-               config.str2bool(self.pki_master_dict['pki_subordinate']):
+            if not config.str2bool(self.pki_master_dict['pki_skip_configuration']) and\
+               ((self.pki_master_dict['pki_subsystem'] == "KRA" or
+                 self.pki_master_dict['pki_subsystem'] == "OCSP") and
+                config.str2bool(self.pki_master_dict['pki_standalone'])):
+                # Stand-alone PKI KRA/OCSP
+                self.pki_master_dict['pki_security_domain_type'] = "new"
+                self.pki_master_dict['pki_issuing_ca'] = "External CA"
+            elif config.pki_subsystem != "CA" or\
+                 config.str2bool(self.pki_master_dict['pki_clone']) or\
+                 config.str2bool(self.pki_master_dict['pki_subordinate']):
                 # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
                 # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
                 # Subordinate CA
@@ -1009,6 +1034,12 @@ class PKIConfigParser:
 
             if not 'pki_import_admin_cert' in self.pki_master_dict:
                 self.pki_master_dict['pki_import_admin_cert'] = 'false'
+            elif not config.str2bool(self.pki_master_dict['pki_skip_configuration']) and\
+                 ((self.pki_master_dict['pki_subsystem'] == "KRA" or
+                   self.pki_master_dict['pki_subsystem'] == "OCSP") and
+                  config.str2bool(self.pki_master_dict['pki_standalone'])):
+                # Stand-alone PKI KRA/OCSP
+                self.pki_master_dict['pki_import_admin_cert'] = 'false'
 
             self.pki_master_dict['pki_ca_signing_tag'] = "signing"
             if self.pki_master_dict['pki_subsystem'] == "CA":
diff --git a/base/server/python/pki/server/deployment/scriptlets/configuration.py b/base/server/python/pki/server/deployment/scriptlets/configuration.py
index 004d8c2..465ccc5 100644
--- a/base/server/python/pki/server/deployment/scriptlets/configuration.py
+++ b/base/server/python/pki/server/deployment/scriptlets/configuration.py
@@ -35,6 +35,12 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
 
     def spawn(self, deployer):
 
+        # ALWAYS establish the following Tomcat instance symbolic link since
+        # this link is required by both automatic pkispawn instance
+        # configuration as well as manual browser GUI instance configuration
+        deployer.symlink.create(deployer.master_dict['pki_systemd_service'],
+                                deployer.master_dict['pki_systemd_service_link'])
+
         if config.str2bool(deployer.master_dict['pki_skip_configuration']):
             config.pki_log.info(log.SKIP_CONFIGURATION_SPAWN_1, __name__,
                                 extra=config.PKI_INDENTATION_LEVEL_1)
@@ -70,8 +76,6 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
             deployer.master_dict['pki_client_key_database'],
             deployer.master_dict['pki_client_secmod_database'],
             password_file=deployer.master_dict['pki_client_password_conf'])
-        deployer.symlink.create(deployer.master_dict['pki_systemd_service'],
-                            deployer.master_dict['pki_systemd_service_link'])
 
         # Start/Restart this Apache/Tomcat PKI Process
         if deployer.master_dict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
diff --git a/base/server/python/pki/server/deployment/scriptlets/finalization.py b/base/server/python/pki/server/deployment/scriptlets/finalization.py
index 0573c24..2e6ce8c 100644
--- a/base/server/python/pki/server/deployment/scriptlets/finalization.py
+++ b/base/server/python/pki/server/deployment/scriptlets/finalization.py
@@ -32,8 +32,12 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
 
     def spawn(self, deployer):
 
-        if deployer.master_dict['pki_subsystem'] == "CA" and\
+        if ((deployer.master_dict['pki_subsystem'] == "CA") or
+            ((deployer.master_dict['pki_subsystem'] == "KRA" or
+              deployer.master_dict['pki_subsystem'] == "OCSP") and
+             config.str2bool(deployer.master_dict['pki_standalone']))) and\
            config.str2bool(deployer.master_dict['pki_external_step_two']):
+            # For External CAs, or Standalone PKI KRAs/OCSPs,
             # must check for 'External CA Step 2' installation PRIOR to
             # 'pki_skip_installation' since this value has been set to true
             # by the initialization scriptlet
diff --git a/base/server/python/pki/server/deployment/scriptlets/initialization.py b/base/server/python/pki/server/deployment/scriptlets/initialization.py
index 54349fc..047d31f 100644
--- a/base/server/python/pki/server/deployment/scriptlets/initialization.py
+++ b/base/server/python/pki/server/deployment/scriptlets/initialization.py
@@ -43,10 +43,13 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         else:
             config.pki_log.info(log.INITIALIZATION_SPAWN_1, __name__,
                                 extra=config.PKI_INDENTATION_LEVEL_1)
-            if deployer.master_dict['pki_subsystem'] == "CA" and\
+            if ((deployer.master_dict['pki_subsystem'] == "CA") or
+                ((deployer.master_dict['pki_subsystem'] == "KRA" or
+                  deployer.master_dict['pki_subsystem'] == "OCSP") and
+                 config.str2bool(deployer.master_dict['pki_standalone']))) and\
                config.str2bool(deployer.master_dict['pki_external_step_two']):
-                # verify that this type of "subsystem" currently EXISTS
-                # for this "instance" (External CA Step 2)
+                # verify that this External CA, or Standalone PKI KRA/OCSP
+                # currently EXISTS for this "instance" (External CA Step 2)
                 deployer.instance.verify_subsystem_exists()
                 deployer.master_dict['pki_skip_installation'] = "True"
             else:
diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn
index 72841c9..cf90954 100755
--- a/base/server/sbin/pkispawn
+++ b/base/server/sbin/pkispawn
@@ -351,9 +351,14 @@ def main(argv):
             print 'ERROR:  Unable to access directory server: ' + e.message['desc']
             sys.exit(1)
 
-        if config.pki_subsystem != "CA" or\
-            config.str2bool(parser.pki_master_dict['pki_clone']) or\
-            config.str2bool(parser.pki_master_dict['pki_subordinate']):
+        if ((config.pki_subsystem == "KRA" or
+             config.pki_subsystem == "OCSP") and
+            not config.str2bool(parser.pki_master_dict['pki_standalone'])) or\
+           config.pki_subsystem == "TKS" or\
+           config.pki_subsystem == "TPS" or\
+           config.str2bool(parser.pki_master_dict['pki_clone']) or\
+           (config.pki_subsystem == "CA" and
+            config.str2bool(parser.pki_master_dict['pki_subordinate'])):
             try:
                 # Verify existence of Security Domain Password
                 if not parser.pki_master_dict.has_key('pki_security_domain_password') or\
@@ -421,17 +426,25 @@ def print_install_information(pki_master_dict):
     else:
         print "      Administrator's username:             %s" % pki_master_dict['pki_admin_uid']
         if os.path.isfile(pki_master_dict['pki_client_admin_cert_p12']):
-            print "      Administrator's PKCS #12 file:\n            %s" % (pki_master_dict['pki_client_dir'] + '/ca_admin_cert.p12')
+            print "      Administrator's PKCS #12 file:\n            %s" % pki_master_dict['pki_client_admin_cert_p12']
         if not config.str2bool(pki_master_dict['pki_client_database_purge']):
             print
-            print "      Administrator's certificate nickname: %s" % pki_master_dict['pki_admin_nickname']
+            print "      Administrator's certificate nickname:\n            %s" % pki_master_dict['pki_admin_nickname']
             print "      Administrator's certificate database:\n            %s" % pki_master_dict['pki_client_database_dir']
         print
         print log.PKI_CHECK_STATUS_MESSAGE % pki_master_dict['pki_instance_name']
         print log.PKI_INSTANCE_RESTART_MESSAGE % pki_master_dict['pki_instance_name']
-        print log.PKI_ACCESS_URL % (pki_master_dict['pki_hostname'],
-                                    pki_master_dict['pki_https_port'],
-                                    config.pki_subsystem.lower())
+        if (((config.pki_subsystem == "KRA" or
+              config.pki_subsystem == "OCSP") and
+             config.str2bool(pki_master_dict['pki_standalone'])) and
+            not config.str2bool(pki_master_dict['pki_external_step_two'])):
+            # Stand-alone PKI KRA/OCSP (External CA Step 1)
+            print
+            print log.PKI_CONFIGURATION_STANDALONE_1 % config.pki_subsystem
+        else:
+            print log.PKI_ACCESS_URL % (pki_master_dict['pki_hostname'],
+                                        pki_master_dict['pki_https_port'],
+                                        config.pki_subsystem.lower())
     print log.PKI_SPAWN_INFORMATION_FOOTER
 
 def log_error_details():
diff --git a/base/server/scripts/operations b/base/server/scripts/operations
index 6d5ee14..d2b666a 100644
--- a/base/server/scripts/operations
+++ b/base/server/scripts/operations
@@ -672,6 +672,39 @@ get_pki_configuration_definitions()
         fi
     fi
 
+    # If ${pki_subsystem} is a DRM or OCSP, check to see if
+    # it is either a Stand-alone DRM or a Stand-alone OCSP
+    #
+    #     NOTE:  Ignore errors when the '<pki>.standalone' parameter
+    #            is not present as this is most likely a legacy instance!
+    #
+    pki_standalone=""
+    if  [ "${pki_subsystem}" == "DRM"  ] ; then
+        line=`grep -e '^[ \t]*kra.standalone[ \t]*=' ${PKI_SUBSYSTEM_CONFIGURATION_FILE}`
+        if [ "${line}" != "" ] ; then
+            pki_standalone=`echo "${line}" | sed -e 's/^[^=]*[ \t]*=[ \t]*\(.*\)/\1/' -e 's/[ \t]*$//'`
+            if [ "${pki_standalone}" == "true" ] ; then
+                # Set a fixed value for "${pki_standalone}"
+                pki_standalone="(Stand-alone)"
+            else
+                # Reset "${pki_standalone}" to be empty
+                pki_standalone=""
+            fi
+        fi
+    elif [ "${pki_subsystem}" == "OCSP" ] ; then
+        line=`grep -e '^[ \t]*ocsp.standalone[ \t]*=' ${PKI_SUBSYSTEM_CONFIGURATION_FILE}`
+        if [ "${line}" != "" ] ; then
+            pki_standalone=`echo "${line}" | sed -e 's/^[^=]*[ \t]*=[ \t]*\(.*\)/\1/' -e 's/[ \t]*$//'`
+            if [ "${pki_standalone}" == "true" ] ; then
+                # Set a fixed value for "${pki_standalone}"
+                pki_standalone="(Stand-alone)"
+            else
+                # Reset "${pki_standalone}" to be empty
+                pki_standalone=""
+            fi
+        fi
+    fi
+
     # Always obtain this PKI instance's "registered"
     # security domain information
     pki_security_domain_name=""
@@ -737,6 +770,13 @@ get_pki_configuration_definitions()
             #
             data="${pki_hierarchy} ${pki_subsystem}"
         fi
+    elif [ "${pki_standalone}" != "" ] ; then
+        # Possible Values:
+        #
+        #     "DRM (Stand-alone)"
+        #     "OCSP (Stand-alone)"
+        #
+        data="${pki_subsystem} ${pki_standalone}"
     else
         # Possible Values:
         #
diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
index 5957f04..d029bd6 100644
--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
@@ -818,6 +818,8 @@ public class CryptoUtil {
         s = s.replaceAll("-----END NEW CERTIFICATE REQUEST-----", "");
         s = s.replaceAll("-----BEGIN CERTIFICATE-----", "");
         s = s.replaceAll("-----END CERTIFICATE-----", "");
+        s = s.replaceAll("-----BEGIN CERTIFICATE CHAIN-----", "");
+        s = s.replaceAll("-----END CERTIFICATE CHAIN-----", "");
 
         StringBuffer sb = new StringBuffer();
         StringTokenizer st = new StringTokenizer(s, "\r\n ");
@@ -844,6 +846,12 @@ public class CryptoUtil {
             if (nextLine.equals("-----END CERTIFICATE-----")) {
                 continue;
             }
+            if (nextLine.equals("-----BEGIN CERTIFICATE CHAIN-----")) {
+                continue;
+            }
+            if (nextLine.equals("-----END CERTIFICATE CHAIN-----")) {
+                continue;
+            }
             sb.append(nextLine);
         }
         return sb.toString();
-- 
1.7.7.6

